Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
983 detections
Filters
Last updated
All Time
Detection languages
638
105
82
64
34
Contributors
242
226
216
58
46
Categories
20,443
11,831
5,872
5,155
4,866
983
Platforms
483
405
224
192
62
Products / Services
416
383
182
108
81
MITRE Techniques
496
496
263
234
233
CVEs
4
4
4
3
3
IDS Classtypes
1
Detects high-frequency authentication failure events targeting multiple unique user accounts from the same source IP address within a 10-minute window. This behavior is indicative of password spraying or credential stuffing attacks against Azure Active Directory (Microsoft Entra ID). The rule specifically monitors for common error codes related to incorrect passwords or account lockout conditions.
This rule monitors for two high-risk behaviors related to Remote Desktop Protocol (RDP) usage: 1) The mstsc.exe process spawning suspicious administrative or scripting tools, and 2) Successful RDP logins originating from non-RFC1918 (external) IP addresses or occurring during non-standard business hours (08:00 PM to 06:00 AM). These patterns are indicative of potential initial access, lateral movement, or post-exploitation activities via RDP.
This rule detects potential SSH brute force attacks by identifying high-frequency authentication failures from sshd logs (more than 10 failures in 5 minutes) and rapid, potentially automated connection attempts on port 22 (more than 20 connections in 1 minute) originating from the same source IP on Linux systems.
Detects Active Directory logons (Event IDs 4624, 4768, 4769) originating from the Fortinet SSL VPN IP pool. In the context of the FortiBleed credential-harvesting campaign, attackers utilize compromised Fortinet VPN credentials to immediately pivot into internal Active Directory environments. Because pure Sigma rules evaluate a single log source, this rule targets the Windows AD telemetry. To achieve the highest fidelity, this rule should be correlated in your SIEM with FortiGate SSL VPN tunnel-up events (e.g., Event Code 32130, 39424) originating from anomalous external IPs for the same principal within a short time window.
Detects Remote Desktop (RDP) logon events (LogonType 10) initiated by common privileged or service-oriented accounts such as administrator, backup_EA, or backup_DA. This behavior may indicate unauthorized remote access or credential abuse using highly privileged accounts.
This rule detects potential RDP lateral movement by identifying accounts that log on to multiple distinct workstations via RDP (LogonType 10) within a one-hour window, where the workstation name is different from the computer name. A logon chain of more than two distinct computers for the same account and IP address within an hour is flagged as suspicious.
Detects a suspicious pattern where a user successfully authenticates via MFA, followed by another successful sign-in attempt for the same account within 10 minutes using a different IP address or user agent. This behavior is often indicative of session hijacking or adversary-in-the-middle (AiTM) attacks where a session token is stolen and replayed from an attacker-controlled environment.
Detects a potential brute force or password spraying attempt by identifying high volumes of NTLM logon failures (Event ID 4625) originating from a single IP address, targeting multiple distinct user accounts within a 10-minute window.
Detects a sequence of events where a user performs a network logon (Event ID 4624, Logon Type 3) followed by a successful Directory Replication Service (DRS) request (Event ID 4662, Access Mask 0x100) on a Domain Controller within a one-hour window. This pattern is indicative of potential lateral movement followed by credential dumping via DCSync, often associated with tools like Mimikatz.
This rule detects authentication events for service accounts (matching patterns like 'svc', 'sa', 'service') originating from at least two different countries within a short time window (30 minutes or less), indicating potential credential compromise and anomalous geographic movement.
Detects the execution of NetExec (formerly CrackMapExec) binaries, associated named pipe creation, and suspicious bursts of authentication activity indicating potential lateral movement or password spraying attacks.
This rule detects potential brute force attacks or username enumeration by identifying 5-minute windows where multiple distinct user accounts trigger a high volume of failed logon events (Event ID 4625). It summarizes failures by timeframe and flags scenarios where more than 5 unique usernames failed to authenticate, categorizing the severity based on the number of accounts affected.
Detects high volumes of authentication failures (EventID 4625) using sub-status 0xC0000064, which indicates the attempted username does not exist. A high frequency of these events targeting multiple non-existent accounts is a strong indicator of automated username enumeration or credential stuffing.
This rule monitors for successful and failed user authentication events (Logon events 4624 and 4625) occurring on Saturdays or Sundays. It calculates a risk score based on the volume of authentication attempts and classifies the activity, providing visibility into potential off-hours credential misuse or insider threat scenarios.
Detects potential password spraying or brute force activity by monitoring Windows Event Code 4625. The rule identifies source IP addresses that have attempted to authenticate against more than 10 unique accounts within a 5-minute window, calculating a spray ratio to differentiate high-intensity credential spraying attempts.
This rule detects anomalous RDP (Logon Type 10) sessions occurring outside of typical business hours or from previously unseen geographic locations, followed closely by the execution of system discovery commands (net.exe, ipconfig.exe, whoami.exe, systeminfo.exe) within a 10-minute window. This behavior is indicative of post-exploitation reconnaissance following an unauthorized or suspicious remote access session.
Detects potential Microsoft 365 session token replay attacks, often associated with Adversary-in-the-Middle (AiTM) kits. The rule identifies suspicious sign-in activity originating from proxy or anonymized IP addresses where MFA was bypassed or incomplete, coupled with a geographic location that deviates from the user's established 30-day baseline or constitutes a new, unseen location.
This rule detects potential AS-REP Roasting activity by monitoring for a single source IP address requesting Kerberos TGTs (Event ID 4768) for multiple distinct user accounts within a 10-minute window. This behavior often indicates an attacker attempting to identify and harvest Kerberos pre-authentication hashes from accounts that do not require pre-authentication, which can then be cracked offline.
Detects Kerberoasting attempts by identifying suspicious Ticket Granting Service (TGS) requests (Event ID 4769) for the 'krbtgt' service or other services where the ticket encryption type is RC4 (0x17) or older/weaker encryption types (0x18), especially when these requests are not preceded by a corresponding Ticket Granting Ticket (TGT) request (Event ID 4768).
Detects instances where a user successfully authenticates using Multi-Factor Authentication (MFA) from one location, followed by a Single-Factor Authentication (SFA) logon from a different location within a 10-minute window. This behavior is indicative of potential session hijacking or session cookie theft where an attacker reuses an authenticated session or manipulates the authentication flow to bypass MFA requirements.
Detects unauthorized access and command execution associated with MSP service accounts. The rule triggers on successful SSH authentication using specific service account names (e.g., egnyteservice) followed by the execution of interactive shells under those same service account contexts, which is indicative of potential lateral movement or compromise in downstream environments.
Page 31 of 47