Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
455 detections
Filters
Last updated
All Time
Detection languages
251
67
56
42
18
Contributors
196
63
61
18
17
Categories
20,401
11,795
5,864
5,145
4,864
Platforms
335
226
118
16
13
Products / Services
292
184
60
48
42
MITRE Techniques
301
233
146
139
97
CVEs
8
7
2
2
IDS Classtypes
2
2
2
IDS Protocols
6
The following analytic identifies a successful Console Login authentication event for an AWS IAM user account without Multi-Factor Authentication (MFA) enabled. It leverages AWS CloudTrail logs to detect instances where MFA was not used during login. This activity is significant as it may indicate a misconfiguration, policy violation, or potential account takeover attempt. If confirmed malicious, an attacker could gain unauthorized access to the AWS environment, potentially leading to data exfiltration, resource manipulation, or further privilege escalation.
The following analytic identifies discrepancies between the IP address of an authentication event and the IP address of the verification response event, focusing on differences in the originating countries. It leverages JSON logs from PingID, comparing the 'auth_Country' and 'verify_Country' fields. This activity is significant as it may indicate suspicious sign-in behavior, such as account compromise or unauthorized access attempts. If confirmed malicious, this could allow attackers to bypass authentication mechanisms, potentially leading to unauthorized access to sensitive systems and data.
The following analytic identifies the provisioning of a new MFA device shortly after a password reset. It detects this activity by correlating Windows Event Log events for password changes (EventID 4723, 4724) with PingID logs indicating device pairing. This behavior is significant as it may indicate a social engineering attack where a threat actor impersonates a valid user to reset credentials and add a new MFA device. If confirmed malicious, this activity could allow an attacker to gain persistent access to the compromised account, bypassing traditional security measures.
The following analytic identifies an attempt to disable multi-factor authentication (MFA) for an Okta user. It leverages OktaIM2 logs to detect when the 'user.mfa.factor.deactivate' command is executed. This activity is significant because disabling MFA can allow an adversary to maintain persistence within the environment using a compromised valid account. If confirmed malicious, this action could enable attackers to bypass additional security layers, potentially leading to unauthorized access to sensitive information and prolonged undetected presence in the network.
Detects when an Okta user's password is reset and MFA factor(s) are deactivated or reset within a 30-minute time window. This activity may indicate that the user account has been compromised, as an attacker might reset the password and then disable MFA to maintain access.
Detects attempts to disable multi-factor authentication for an AWS IAM user by monitoring AWS CloudTrail events for 'DeleteVirtualMFADevice' or 'DeactivateMFADevice' actions. This could indicate an adversary attempting to maintain persistent access or bypass MFA for compromised accounts.
Detects when a user removes an authentication factor or OTP device within OneLogin. This action can weaken security by removing a layer of multi-factor authentication, potentially making the account more vulnerable to compromise.
Detects a successful login after multiple failed OTP intents
Detects when a user removes an authentication factor or otp device.
Detects when an Okta user failed a number challenge during push notification.
Detects attempts to disable multi-factor authentication for an AWS IAM user.
Detects when an Okta user rejects more than 2 Push notifications in a 10 minute window.
Identifies when multi-factor authentication (MFA) is disabled for a Google Workspace organization. Security teams can monitor for changes to MFA configuration that may weaken the organization's security posture.
Detects when multi-factor authentication (MFA) is disabled in Google Workspace. This could indicate an adversary attempting to weaken security controls for persistent access or to facilitate further compromise.
Page 22 of 22