Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,666 detections
Filters
Last updated
All Time
Detection languages
1,077
189
170
102
53
Contributors
520
361
306
67
52
Categories
20,443
11,831
5,872
5,155
4,866
1,666
Platforms
1,091
591
441
252
122
Products / Services
1,130
476
189
125
117
MITRE Techniques
945
843
438
416
413
CVEs
12
12
9
6
5
IDS Classtypes
1
1
Detects successfully authenticated user logins to Okta based on Okta's Behavior Detection pattern analysis, specifically looking for high-risk indicators such as new geo-location, new device, new IP, new city, new state, new country, or velocity anomalies. It also flags logins originating from unauthorized target geographies like Cuba, Iran, North Korea, Russia, and Syria. The rule only applies to existing users, not newly created ones.
This rule identifies a suspicious sequence of events within Google Workspace. Specifically, it triggers when a user successfully logs in under suspicious circumstances (indicated by the 'is_suspicious' label) and subsequently downloads a file from Google Drive. The rule correlates these two events by the user ID and ensures the download occurs after the suspicious login, within a 1-hour window.
This rule detects a successful login to the AWS console after multiple failed login attempts for the same user within a 15-minute window. It specifically looks for at least three failed authentication attempts followed by one successful authentication. The rule also calculates a risk score based on potential country mismatches between failed and successful attempts, and successful logins from unauthorized geographies (Cuba, Iran, North Korea, Russia, Syria).
This rule identifies when a Google Workspace user shares a file on Google Drive shortly after a suspicious login event has occurred. It correlates a successful login event flagged as suspicious with subsequent Google Drive file sharing activities (changing user access, document visibility, access scope, or ACL editors) by the same user within a one-hour window. This behavior could indicate an attacker gaining access to an account and then exfiltrating data.
This rule detects when an AWS user successfully authenticates to the AWS console from more than one unique IP address within a 5-minute window. This behavior can indicate a compromised account being accessed from multiple locations, potentially by different attackers, or by an attacker using a VPN/proxy service that rapidly changes IP addresses. The rule also includes an outcome that calculates a risk score based on successful logins originating from specific high-risk countries (Cuba, Iran, North Korea, Russia, Syria).
Detects when a user creates or updates a login profile for another user in AWS IAM and then the newly created/modified user logs in from the same IP address. This behavior can indicate privilege escalation where an attacker gains access to an existing user's credentials, creates a new login profile or modifies an existing one for another user, and then uses that new profile to log in, potentially escalating their privileges or maintaining persistence.
Detects when a single user successfully logs into Okta from multiple distinct cities within a 24-hour period. This behavior can indicate a compromised account being used by an attacker from a different geographical location than the legitimate user, or a user traveling rapidly between distant locations. The rule also incorporates risk scoring based on Okta ThreatInsight and logins from suspicious countries.
This rule detects a successful OneLogin login event that is preceded by multiple failed One-Time Password (OTP) attempts within a 15-minute window for the same user. Specifically, it looks for at least four failed OTP challenges followed by a successful OTP verification and then a successful user login. This pattern is indicative of an OTP brute-force attack where an attacker is attempting to guess the correct OTP.
This rule detects successful user authentications to Okta that occur outside of typical business hours or on weekends. It specifically flags logins on Saturdays and Sundays, and logins between 8 PM and 7 AM UTC on weekdays. The rule calculates a risk score based on the day and time of the login, with higher scores for weekend logins and late-night/early-morning logins.
Identifies when a Google Workspace user downloads a file from Google Drive after a suspicious login event occurred.
Detects successfully authenticated user logins based on Okta's Behavior Detection pattern analysis.
Detects a successful login after multiple failed OTP intents
Detect when a user logs into AWS console without MFA.
Detects a successful login after multiple failed MFA pushes
Detects multiple failed requests to access applications
Identifies when a Google Workspace user shares a file on Google Drive after a suspicious login event occurred.
Detect when an IAM session token is created and used from a different IP.
Detect when a user creates or updates a login profile for another user and escalates privileges using this new user from the same IP.
Detects when an AWS user successfully authenticating from more than one unique IP address within 5 minutes.
Detects successful login after multiple failed attempts
Detects out of hours successful authentication.
Page 79 of 80