Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
780 detections
Filters
Last updated
All Time
Detection languages
429
116
112
63
22
Contributors
176
85
81
80
70
Categories
20,443
11,831
5,872
5,155
4,866
780
Platforms
339
222
141
139
71
Products / Services
318
166
85
57
49
MITRE Techniques
413
348
254
231
200
CVEs
5
5
3
2
2
IDS Classtypes
7
2
1
1
1
IDS Protocols
8
2
1
1
This rule detects large-scale, non-interactive password-spraying campaigns targeting Microsoft Entra ID (Azure AD) accounts. It specifically identifies anomalous login behavior originating from Azure CLI or similar non-interactive clients, where a single source IP attempts to authenticate against a large number of distinct user accounts with a low number of failures per user within a short timeframe, characteristic of 'low-and-slow' password spraying.
Detects the TeamFiltration/UNK_CondorFiltration spray signature: a large
number of distinct target UserPrincipalNames within a single tenant, each
receiving only a handful of sign-in attempts, spread across many distinct
AWS EC2-hosted source IPs/regions within a short time window. Individual
sign-ins from AWS-hosted IP ranges (VPN gateways, corporate cloud proxies,
remote contractors) are not flagged on their own; the rule requires both
the account-fanout and the IP-rotation dimensions to co-occur for the same
tenant in the same window.
number of distinct target UserPrincipalNames within a single tenant, each
receiving only a handful of sign-in attempts, spread across many distinct
AWS EC2-hosted source IPs/regions within a short time window. Individual
sign-ins from AWS-hosted IP ranges (VPN gateways, corporate cloud proxies,
remote contractors) are not flagged on their own; the rule requires both
the account-fanout and the IP-rotation dimensions to co-occur for the same
tenant in the same window.
Detects a credential stuffing attack characterized by a high volume of failed authentication attempts from a small set of source IP addresses followed by a successful authentication within a short timeframe. This behavior is indicative of an attacker attempting to use valid credentials obtained from infostealer logs or credential leaks to gain unauthorized access to accounts.
Detects a sequence of events characteristic of exploitation against RouterOS (CVE-2026-67276/CVE-2026-86060), involving a failed SSH login attempt with the username '-2', followed by the creation of a new user account within the same SSH session, and a successful login with that newly created account.
Detects a sequence of events characteristic of exploitation against RouterOS (CVE-2026-67276/CVE-2026-86060), involving a failed SSH login attempt with the username '-2', followed by the creation of a new user account within the same SSH session, and a successful login with that newly created account.
Detects anomalous AWS activity combining bulk secret retrieval from AWS Secrets Manager using the BatchGetSecretValue API with subsequent authentication failures or validation errors in AWS STS. This behavior is indicative of automated credential harvesting pipelines or agentic frameworks rapidly enumerating and testing stolen credentials.
This rule detects potential RDP brute force and password spraying attacks by correlating Windows Event ID 4625 (failed logins) and 4624 (successful logins) via RDP (Logon Type 10). It monitors for high volumes of failed attempts across multiple accounts or high volume of failed attempts from a single source, followed by successful authentication from the same source.
The following analytic identifies instances where CrushFTP has blocked access due to exceeding the maximum number of simultaneous connections from a single IP address. This activity may indicate brute force attempts, credential stuffing, or automated attacks against the CrushFTP server. This detection is particularly relevant following the discovery of CVE-2025-31161, an authentication bypass vulnerability in CrushFTP versions 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0.
Detects anomalous Kerberos TGT (AS-REQ/AS-REP) activity using Event ID 4768. The rule identifies two scenarios: (1) TGT requests that fail with specific status codes indicating issues with the account (disabled, nonexistent, or locked), and (2) TGT requests that utilize RC4 encryption with classic Golden Ticket flags (renewable/forwardable). These patterns are indicative of potential Kerberos abuse, including attempts to use compromised accounts or forged golden tickets.
Detects potential password spraying activity targeting Azure AD accounts. The rule identifies a pattern where a single source IP address attempts to authenticate against a high volume of distinct accounts within a one-hour window, while keeping the number of failed attempts per individual account low to evade traditional brute force thresholds.
Detects a suspected account takeover pattern where an Azure AD account logs into the Azure Portal shortly after experiencing failed authentication attempts from the same IP address. The detection correlates password spraying or VPN probing activity (multiple failed logins against different users from a single IP) with subsequent successful or near-successful logins (MFA enrollment interrupts) on the Azure Portal, signaling potential post-compromise activity.
Detects the TeamFiltration/UNK_CondorFiltration spray signature: a large
number of distinct target UserPrincipalNames within a single tenant, each
receiving only a handful of sign-in attempts, spread across many distinct
AWS EC2-hosted source IPs/regions within a short time window. Individual
sign-ins from AWS-hosted IP ranges (VPN gateways, corporate cloud proxies,
remote contractors) are not flagged on their own; the rule requires both
the account-fanout and the IP-rotation dimensions to co-occur for the same
tenant in the same window.
number of distinct target UserPrincipalNames within a single tenant, each
receiving only a handful of sign-in attempts, spread across many distinct
AWS EC2-hosted source IPs/regions within a short time window. Individual
sign-ins from AWS-hosted IP ranges (VPN gateways, corporate cloud proxies,
remote contractors) are not flagged on their own; the rule requires both
the account-fanout and the IP-rotation dimensions to co-occur for the same
tenant in the same window.
Detects a distributed password spraying campaign targeting cloud accounts, characterized by a large number of distinct accounts being targeted simultaneously from multiple AWS-hosted IP addresses, with a low volume of attempts per account per hour to evade standard threshold-based detection.
Detects an authentication pattern characteristic of credential compromise, consisting of a burst of failed authentication attempts against an account within a short window, followed immediately by a successful sign-in from an anomalous or new device/location. This pattern is indicative of brute-force or credential spraying followed by successful validation and potential lateral movement.
Detects potential password spraying activity by identifying high-volume failed authentication attempts (ResultType 50126 or 50053) against multiple accounts from a single source IP, followed by a successful authentication from the same IP. This pattern indicates an adversary who has identified one or more valid credentials after an initial spraying campaign.
Detects anomalous access patterns to machine learning model inference endpoints, including unauthorized access attempts such as credential failures, scope violations, and quota exhaustion, indicating potential misuse or compromise of private model APIs.
Detects a suspicious pattern of activity where a single source IP performs network reconnaissance followed by rapid-fire failed authentication attempts against multiple distinct hosts within a short time window. This behavior is indicative of automated, agentic AI-driven offensive tooling rather than manual activity.
Detects a high volume of failed SSH password authentication attempts from a single source IP address against one or more target hosts within a short time window, which is indicative of an SSH brute-force attack.
Detects a sequence of events characteristic of exploitation against RouterOS (CVE-2026-67276/CVE-2026-86060), involving a failed SSH login attempt with the username '-2', followed by the creation of a new user account within the same SSH session, and a successful login with that newly created account.
Detects suspicious AI inference API activity indicative of credential compromise or misuse. The rule identifies three main signals: rapid authentication failures (credential stuffing), anomalous geolocation/ASN usage for successful requests, and successful API calls occurring after a key rotation event.
Detects potential lateral movement or pivot attempts by correlating repeated failed RDP logons (RemoteInteractive) against sensitive targets (Domain Controllers, File Servers, Backup Servers) with concurrent security tool blocks (e.g., Microsoft Defender Antivirus, Exploit Guard) on the originating beachhead device within a 4-hour window.
Page 4 of 38