Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
32 detections
Filters
Last updated
All Time
Detection languages
11
7
5
4
2
Contributors
6
6
4
3
2
Categories
20,401
11,795
5,864
5,145
4,864
Platforms
13
9
8
2
1
Products / Services
9
7
6
5
4
MITRE Techniques
16
14
13
12
10
CVEs
1
IDS Classtypes
2
IDS Protocols
2
Detects a cluster of Windows Event IDs 4740 (Account Lockout) or 4724 (Password Reset) targeting the local 'Administrator' account across multiple hosts within a short time window. This activity is indicative of automated or mass account manipulation often associated with ransomware payloads or centralized GPO-based credential tampering.
The following analytic identifies user accounts experiencing more than 5 account lockouts within a 5-minute time window.
It leverages the 'Change' data model and groups account lockout events into 5-minute time buckets to identify a high frequency of lockouts associated with the same user and destination.
This activity may indicate password spraying, brute-force activity, or repeated authentication attempts using invalid or outdated credentials.
If confirmed malicious, this behavior may indicate an attempt to gain unauthorized access to user accounts and could precede further compromise or lateral movement within the environment.
It leverages the 'Change' data model and groups account lockout events into 5-minute time buckets to identify a high frequency of lockouts associated with the same user and destination.
This activity may indicate password spraying, brute-force activity, or repeated authentication attempts using invalid or outdated credentials.
If confirmed malicious, this behavior may indicate an attempt to gain unauthorized access to user accounts and could precede further compromise or lateral movement within the environment.
Detects user account lockouts or instances where a user has been flagged for frequent failed authentication attempts within the Duo Security platform. This activity is indicative of brute force attacks, credential stuffing, or attempts to bypass Multi-Factor Authentication (MFA) via fatigue or repeated request generation.
Detects potential credential harvesting or account enumeration activity by identifying successful enumeration of user accounts (via specific sign-in result codes) followed by a spike in account lockouts for the same users within a 60-minute window. This behavior is indicative of an attacker verifying valid accounts before launching a targeted brute force or credential stuffing campaign.
Detects a high-volume burst of ROPC (Resource Owner Password Credentials) sign-in attempts using a spoofed/unregistered OAuth client ID, identified by a populated Application ID field paired with a blank Application Name field, targeting a single account within a short window. This enumeration pattern has been observed to correlate with mass account lockouts across an organization.
Detects non-interactive sign-ins to Azure CLI using the 'python-requests' User-Agent by non-administrative users. This pattern is associated with the LSHIY password spray campaign, which exploits the OAuth ROPC flow for credential abuse against Microsoft 365.
Detects Windows accounts that have been locked out due to repeated authentication failures (EventCode 4625 with Status 0xC0000234). The rule summarizes account lockouts by user, tracks source IP addresses to identify potential brute force or password spray activity, and flags whether multiple source IPs were involved in the lockout.
Detects Windows accounts that have been locked out due to repeated authentication failures (EventCode 4625 with Status 0xC0000234). The rule summarizes account lockouts by user, tracks source IP addresses to identify potential brute force or password spray activity, and flags whether multiple source IPs were involved in the lockout.
Detects when an actor searches Slack audit logs, which could indicate an attacker attempting to understand logging capabilities or evade detection. Also detects bulk session resets initiated by an administrator, which may be a response to an account takeover or an attacker attempting to evict legitimate users from their sessions.
Detects when an actor searches Slack audit logs, which could indicate an attacker attempting to understand logging capabilities or evade detection. Also detects bulk session resets initiated by an administrator, which may be a response to an account takeover or an attacker attempting to evict legitimate users from their sessions.
Detects when an actor searches Slack audit logs, which could indicate an attacker attempting to understand logging capabilities or evade detection. Also detects bulk session resets initiated by an administrator, which may be a response to an account takeover or an attacker attempting to evict legitimate users from their sessions.
This rule detects potential credential stuffing or password spraying attacks against Okta by monitoring for a high volume of failed primary authentication attempts from a single source IP address or ASN within a one-hour window. It also incorporates corroborating evidence such as account lockouts, Okta ThreatInsight detections, and blocked requests. The rule surfaces both failed attempts and successful logins that might indicate a compromised account.
This rule detects attempts to remotely lock out user accounts via SMB (Server Message Block) by looking for specific content within TCP traffic on port 445. It specifically targets the 'NetUserSetInfo' function call, which can be used to modify user account properties, in conjunction with the keyword 'lockout'. This combination suggests an attacker is attempting to trigger a mass account lockout.
This rule detects a mass account lockout pattern over LDAP. It triggers an alert if 20 or more LDAP requests containing the string "lockoutTime" are observed from a single destination IP address within a 60-second window. This behavior is indicative of an attacker attempting to lock out multiple user accounts, potentially as a denial-of-service attack or to facilitate other attacks like password spraying by preventing legitimate users from logging in.
Detects when an user account is locked out.
This query analyzes login events to identify users with more than five failed login attempts. It filters for login-related events, groups the data by username, endpoint name, failure reason, login type, and associated indicators, then counts the number of failed attempts. The results are sorted in descending order of failed attempts to highlight potentially suspicious activity.
Detects when a user account in Okta is locked out due to exceeding the maximum number of sign-in attempts. This can indicate brute-force attacks, password spraying, or legitimate users forgetting their passwords.
This rule detects when a user account in OneLogin is locked or suspended, either through the API or other system actions. This could indicate an attempt to disrupt user access or a response to suspicious activity.
Detects when an user account is locked or suspended.
This query shows authentication methods being added and devices registered around the time of a high risk sign in which could indicate an attempt to establish persistence on a compromised account. The threshold can be changed to a wider timeframe if needed.
'Detects Active Directory account lockouts'
Page 1 of 2