Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
304 detections
Filters
Last updated
All Time
Detection languages
161
41
35
31
16
Contributors
117
32
24
22
21
Categories
195
89
66
58
57
Platforms
112
82
58
58
26
Products / Services
67
46
45
44
42
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
CVEs
5
2
2
2
1
IDS Classtypes
35
3
2
1
1
IDS Protocols
37
3
1
1
This rule detects potential SSH brute force attacks by monitoring syslog for multiple failed SSH login attempts, connection closures, or invalid user attempts from a single source IP address within a short time frame. It specifically looks for keywords like 'error', 'Connection closed', 'authentication failure', and 'invalid user' in SSHD logs.
AWS Console Brute Force Activity
Cortex XDR
Detects repeated failed AWS console login attempts from the same IP address within a one-hour window, indicating a potential brute-force attack against AWS accounts.
This rule detects potential SSH brute force attacks by identifying multiple failed password attempts from a single source IP address to a specific computer within a 5-minute window. It specifically looks for 'Failed password' messages in syslog entries from the 'sshd' process.
Detects multiple failed SSH login attempts from a single source IP address, indicating a potential brute force attack. The rule identifies 'Invalid user' or 'Failed password' messages in syslog from the 'sshd' process and groups them by source IP and time to count unique attempted users and total attempts. A threshold of more than 5 attempted users from a single source IP within a 10-minute window triggers an alert.
This rule detects potential brute force or credential stuffing attacks against Azure AD by identifying multiple failed sign-in attempts followed by a successful sign-in from the same user and IP address within a short time frame (1 minute). It specifically looks for scenarios where the successful sign-in occurs after the failed attempts and involves different applications, excluding common Office 365 services to reduce noise.
Detects a high volume of network connections from a browser process to a high port on the local host (127.0.0.1 or ::1). This pattern can indicate a malicious website attempting to brute-force credentials for a local service, such as the OpenClaw AI agent, by abusing the browser's permission to establish WebSocket connections to localhost. The vulnerable service may not rate-limit these local connections, allowing for rapid password guessing.
This rule detects potential brute force login attempts against Windows systems by monitoring Windows Security Event ID 4625 (failed logon attempts). It aggregates failed attempts by IP address and computer within a 15-minute window and triggers an alert if the number of failed attempts exceeds a defined threshold (default 10). This indicates an adversary systematically guessing passwords to gain unauthorized access.
This rule detects an unusually high number of NTLM logon attempts (more than 3 within a 10-minute window) from a single IP address to various accounts or workstations. This behavior is indicative of a brute-force attack or password guessing attempt against network services, particularly when the logon type is network (3) or remote interactive (10) and not from localhost.
This rule detects inbound SSH connections originating from external IP addresses to systems running SSH services. It specifically looks for successful incoming network connections where the destination port is commonly associated with SSH (22, 222, 2222, 8022) or the source process name is an SSH daemon (sshd, dropbear). The rule explicitly excludes connections from private IP ranges and certain common web server processes on standard web ports to reduce false positives. The threat model includes unauthorized external SSH access, brute-force/credential-stuffing attacks, backdoor SSH daemons, compromised servers accepting attacker sessions, and reverse shell callbacks.
This rule detects multiple failed logon attempts (more than 5 within a 5-minute window) for user accounts from a single IP address. This behavior is indicative of a brute-force attack or password guessing attempt against user accounts.
Detects a high volume of Kerberos pre-authentication failures (Event ID 4771, Status 0x18) against multiple distinct user accounts originating from a single source IP address within a short time window. This behavior is characteristic of password spraying attacks where an attacker attempts a small number of common passwords across many accounts to avoid lockouts and detection in a Windows Active Directory environment.
Detects successful brute force attacks: 10+ login failures within 10 minutes followed by successful login within 1 hour, excluding trusted networks and whitelisted accounts
Detect Attempt PrintNightmare (CVE-2021-1675) Remote code execution in Windows Spooler Service
This rule detects failed user login attempts within Bitbucket. It specifically looks for audit events categorized as 'Authentication' with the action 'User login failed'. This type of event can indicate various activities, including legitimate users mistyping passwords, or malicious actors attempting to brute-force credentials or perform credential stuffing attacks against Bitbucket accounts.
Detects SSH user login access failures in Bitbucket. This rule can be noisy and is recommended to be used with correlation based on the "author.name" field to reduce false positives.
This detection identifies single-factor ROPC (Resource Owner Password Credentials) logins from new countries not seen in the last 14 days for a given user+app combination. ROPC authentication does not support MFA, making it a frequent vector for attackers to bypass MFA misconfigurations and gain initial access or escalate privileges in Azure AD.
Detects failed AWS console login attempts due to authentication failures. Monitoring these events is crucial for identifying potential brute-force attacks or unauthorized access attempts to AWS accounts.
This rule detects login attempts against the Telnet service running on an OpenCanary honeypot. OpenCanary is designed to attract and detect unauthorized access attempts, so any login attempt to its Telnet service indicates potential malicious activity or reconnaissance against the honeypot.
This detection identifies signs of SSH brute-force attacks by monitoring for a high number of failed login attempts within a short time frame. Such activity may indicate an attacker attempting to gain unauthorized access through password guessing.
Researching about how to classify ISP based on different factors, I created a query based on ISP sign-in attempts.
Detects M365 Copilot users with failed authentication attempts, MFA failures, or multi-location access patterns indicating potential credential attacks or account compromise. The detection aggregates M365 Copilot Graph API authentication events per user, calculating metrics like distinct cities/countries accessed, unique IP addresses and browsers, failed login attempts (status containing "fail" or "error"), and MFA failures (error code 50074). Users are flagged when they access Copilot from multiple cities (cities_count > 1), experience any authentication failures (failed_attempts > 0), or encounter MFA errors (mfa_failures > 0), which are indicators of credential stuffing, brute force attacks, or compromised accounts attempting to bypass multi-factor authentication.
Page 11 of 15