Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
304 detections
Filters
Last updated
All Time
Detection languages
161
41
35
31
16
Contributors
117
32
24
22
21
Categories
195
89
66
58
57
Platforms
112
82
58
58
26
Products / Services
67
46
45
44
42
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
5
2
2
2
1
IDS Classtypes
35
3
2
1
1
IDS Protocols
37
3
1
1
This rule detects suspected brute force attacks against Okta accounts. It triggers when Okta ThreatInsight identifies multiple login failures from the same IP address across one or more Okta organizations. The rule also increases the risk score if the IP address is marked as suspicious by Okta ThreatInsight or if the login attempts originate from specific high-risk countries (Cuba, Iran, North Korea, Russia, Syria).
This rule detects multiple failed login attempts from different users originating from the same IP address within a one-hour window in Okta. It specifically looks for events where the login attempt was blocked due to invalid credentials. The rule also incorporates risk scoring based on Okta ThreatInsight detections and behavioral patterns like new geo-location, device, or IP, as well as logins from unauthorized geographies (Cuba, Iran, North Korea, Russia, Syria). The detection is triggered if more than 5 distinct user IDs attempt to log in with invalid credentials from the same IP within the specified timeframe.
Detects suspicious rejected SMB guest logon attempts from an IP address, which can be an indicator of an attempted PrintNightmare (CVE-2021-1675) remote code execution exploit or other brute-force/password guessing attacks against SMB. The rule specifically looks for EventID 31017 (SMB client security event for rejected guest logon) where the UserName is empty and the ServerName starts with '\1', which is often seen in exploit attempts.
This rule detects NTLM brute force attempts by identifying specific workstation names commonly used by NTLM brute-forcing tools. It looks for Event ID 8004 in the Microsoft-Windows-NTLM/Operational log, specifically when the 'WorkstationName' field matches a list of known tool-related or generic Windows names.
Identifies user accounts that have been locked due to multiple failed sign-in attempts with incorrect credentials. This often indicates a brute-force attack or password guessing attempt against user accounts.
This rule detects the use of weak or commonly abused passwords directly within command-line interfaces. Threat actors often use this method to create new user accounts with easily guessable or known compromised passwords. The rule specifically looks for a predefined list of weak passwords appearing in the command line of a process creation event.
This rule detects suspicious PowerShell script blocks that contain specific .NET classes often used in LDAP-based credential access attempts. The presence of 'System.DirectoryServices.Protocols.LdapDirectoryIdentifier', 'System.Net.NetworkCredential', and 'System.DirectoryServices.Protocols.LdapConnection' within a PowerShell script block suggests an attempt to interact with an LDAP directory, potentially for password guessing or brute-force attacks against accounts.
This rule detects the execution of the password guessing hack tool Hydra based on specific command-line parameters. It looks for the presence of '-u ' and '-p ' which are commonly used to specify username and password lists, respectively. Additionally, it checks for the keywords '^USER^' and '^PASS^' which are often used as placeholders in Hydra's command-line arguments for iterating through user and password lists during a brute-force attack.
Detects command line parameters used by Hydra password guessing hack tool
Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts.
Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism
Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism
Page 15 of 15