Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
304 detections
Filters
Last updated
All Time
Detection languages
161
41
35
31
16
Contributors
117
32
24
22
21
Categories
195
89
66
58
57
Platforms
112
82
58
58
26
Products / Services
67
46
45
44
42
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
CVEs
5
2
2
2
1
IDS Classtypes
35
3
2
1
1
IDS Protocols
37
3
1
1
This rule detects multiple failed SSL login attempts from a single source IP to a destination IP within a 24-hour period. A threshold of 10 failed attempts is used to identify potential brute-force attacks or credential stuffing against SSL-enabled services.
Detects failed AWS console login attempts due to authentication failures. Monitoring these events is crucial for identifying potential brute-force attacks or unauthorized access attempts to AWS accounts.
The analytic identifies potential Remote Desktop Protocol (RDP) brute force attacks by monitoring network traffic for RDP application activity. It detects potential RDP brute force attacks by identifying source IPs that have made more than 10 connection attempts to the same RDP port on a host within a one-hour window. The results are presented in a table that includes the source and destination IPs, destination port, number of attempts, and the times of the first and last connection attempts, helping to prioritize IPs based on the intensity of activity.
Detects activity related to exploitation of Ivanti Connect Secure vulnerabilities (CVE-2025-0282, CVE-2025-22457) using MDifyLoader, Cobalt Strike, vshell, DslogdRAT, and Fscan. Includes file, process, and network-based IOCs from JPCERT report.
KQL Query from file: Threat Hunt: Potential Password Spray Attacks
KQL Query from file: Monitor Privilege User SSPR
KQL Query from file: Azure CLI Spray - ASN 53667
KQL Query from file: Threat hunting voice phishing for Teams
KQL Query from file: Hunting fasthttp Bruteforce Campaign
KQL Query
KQL Query from file: KQL to check Azure API spray attacks
KQL Query from file: Sentinel Timeroasting KQL detection
KQL Query
'Identifies evidence of brute force activity against a user based on multiple authentication failures and at least one successful authentication within a given time window.
Note that the query does not enforce any sequence, and does not require the successful authentication to occur last.
The default failure threshold is 10, success threshold is 1, and the default time window is 20 minutes.
To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimAuthentication)'
Note that the query does not enforce any sequence, and does not require the successful authentication to occur last.
The default failure threshold is 10, success threshold is 1, and the default time window is 20 minutes.
To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimAuthentication)'
'Summarize all the failures and success events for all users in the last 24 hours,
only identify users with more than 100 failures in the set period'
only identify users with more than 100 failures in the set period'
This query looks for a large number of network-based authentications using local credentials coming from a single source IP address. High counts of logons involving a large number of distinct machines may identify an attacker beachhead within an enterprise.
'Identifies IPs with failed attempts to sign in to one or more disabled accounts signed in successfully to another account.
This analytic will additionally identify the successful signed in accounts as the mapped account entities for investigation.
References: https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-sign-ins-error-codes
50057 - User account is disabled. The account has been disabled by an administrator.'
This analytic will additionally identify the successful signed in accounts as the mapped account entities for investigation.
References: https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-sign-ins-error-codes
50057 - User account is disabled. The account has been disabled by an administrator.'
Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts.
Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism
Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism
'Identifies sign-in anomalies from an IP in the last hour, targeting multiple users where the password is correct after multiple attempts'
'This hunting query looks for users who have multiple failed queries in a short space of time.'
Private Key Files.
This query identifies file operation with files having.
One of the extensions commonly used to save a private.
Key. The risk is that if an attacker were to obtain.
The file, they could brute force any password on it.
And potentially obtain a powerful certificate. To do.
This, they would only need to obtain read access to.
The file.
The risk associated with these files is heavily.
Determined by the value of the certificate. For example,.
Loss of a self-signed certificate created by Adobe Acrobat.
Is significantly less impactful than loss of a website.
SSL certificate.
Recommendation: Know where these files are, and if possible.
Back them up and remove them. You might also consider.
Creating an informational alert.
This query identifies file operation with files having.
One of the extensions commonly used to save a private.
Key. The risk is that if an attacker were to obtain.
The file, they could brute force any password on it.
And potentially obtain a powerful certificate. To do.
This, they would only need to obtain read access to.
The file.
The risk associated with these files is heavily.
Determined by the value of the certificate. For example,.
Loss of a self-signed certificate created by Adobe Acrobat.
Is significantly less impactful than loss of a website.
SSL certificate.
Recommendation: Know where these files are, and if possible.
Back them up and remove them. You might also consider.
Creating an informational alert.
Page 12 of 15