Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
608 detections
Filters
Last updated
All Time
Detection languages
346
84
61
42
40
Contributors
155
87
50
48
42
Categories
348
215
150
124
82
Platforms
197
190
120
88
75
Products / Services
169
92
45
44
43
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
10
5
1
1
1
IDS Classtypes
35
4
4
3
IDS Protocols
35
6
1
1
Okta ThreatInsight detects multiple login failures from the same IP across one or more Okta orgs.
Okta's ThreatInsight can identify Password Spray attacks.
Amazon GuardDuty detects a brute force activity in an Amazon EC2 or Amazon RDS instance.
Okta's ThreatInsight can identify multiple login failures with high unknown users count from the same IP across one or more Okta orgs.
Detects when an Okta user rejects more than 2 Push notifications in a 10 minute window.
This rule detects suspicious user agent strings commonly used by various hacking tools, including vulnerability scanners, brute-force tools, and SQL injection tools, within proxy logs. The rule identifies specific strings indicative of tools like Arachni, Hydra, DirBuster, SQLMap, and others, which are often employed during reconnaissance, initial access, and credential access phases of an attack.
This rule detects successful password spray activity. A password spray attack involves an adversary attempting a single or small list of commonly used passwords against many different accounts to acquire valid credentials, often to avoid account lockouts. The detection specifically triggers when Azure AD Identity Protection identifies a 'passwordSpray' risk event.
This rule detects NTLM brute force attempts by identifying specific workstation names commonly used by NTLM brute-forcing tools. It looks for Event ID 8004 in the Microsoft-Windows-NTLM/Operational log, specifically when the 'WorkstationName' field matches a list of known tool-related or generic Windows names.
Detects Border Gateway Protocol (BGP) authentication failures, which can indicate attempts to brute force BGP peer authentication. Such attacks aim to manipulate routing information, potentially leading to traffic redirection or denial of service.
Identifies user accounts that have been locked due to multiple failed sign-in attempts with incorrect credentials. This often indicates a brute-force attack or password guessing attempt against user accounts.
This rule detects log entries from Juniper BGP services indicating a missing MD5 digest. This condition can be a sign of a brute-force attack attempting to manipulate routing protocols, potentially leading to BGP hijacking or other network disruptions. BGP uses MD5 for authentication to ensure the integrity and authenticity of routing updates between peers. A missing MD5 digest suggests that an unauthenticated or malicious peer is attempting to establish a connection or send updates.
Detects BGP failures which may be indicative of brute force attacks to manipulate routing.
Detects Label Distribution Protocol (LDP) authentication failures on Cisco devices, which could indicate an adversary attempting to brute force LDP authentication to manipulate MPLS labels. This could be part of an effort to disrupt network traffic or gain unauthorized access.
This rule detects the use of weak or commonly abused passwords directly within command-line interfaces. Threat actors often use this method to create new user accounts with easily guessable or known compromised passwords. The rule specifically looks for a predefined list of weak passwords appearing in the command line of a process creation event.
This rule detects the execution of the password guessing hack tool Hydra based on specific command-line parameters. It looks for the presence of '-u ' and '-p ' which are commonly used to specify username and password lists, respectively. Additionally, it checks for the keywords '^USER^' and '^PASS^' which are often used as placeholders in Hydra's command-line arguments for iterating through user and password lists during a brute-force attack.
This rule detects common flag combinations used by CrackMapExec, a post-exploitation tool, to identify its execution even if the binary name has been changed. It looks for specific command-line arguments related to local authentication, hash-based authentication, and module usage for SMB and MSSQL protocols.
Indicates that a password spray attack has been successfully performed.
Detects command line parameters used by Hydra password guessing hack tool
NTLM Brute Force
Sigma
Detects common NTLM brute force device names
Account Lockout
Sigma
Identifies user account which has been locked because the user tried to sign in too many times with an incorrect user ID or password.
Page 29 of 29