Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
304 detections
Filters
Last updated
All Time
Detection languages
161
41
35
31
16
Contributors
117
32
24
22
21
Categories
195
89
66
58
57
Platforms
112
82
58
58
26
Products / Services
67
46
45
44
42
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
5
2
2
2
1
IDS Classtypes
35
3
2
1
1
IDS Protocols
37
3
1
1
Detects successful authentication events using known default or low-privileged Cisco Firepower Management Center (FMC) service accounts, or IDS alerts (Snort SID 66883) associated with credential abuse activity potentially related to CVE-2026-20316.
This rule detects high-frequency interaction with the Exchange REST API originating from user agents identified as 'One Outlook Web', potentially indicative of automated password spraying or brute force attacks targeting cloud mailboxes. This rule identifies the underlying event pattern and should be paired with a scheduled/aggregation rule to detect the volume threshold (e.g., 500+ events per hour).
Detects successful authentication events using known default or low-privileged Cisco Firepower Management Center (FMC) service accounts, or IDS alerts (Snort SID 66883) associated with credential abuse activity potentially related to CVE-2026-20316.
Detects successful authentication events using known default or low-privileged Cisco Firepower Management Center (FMC) service accounts, or IDS alerts (Snort SID 66883) associated with credential abuse activity potentially related to CVE-2026-20316.
Detects anomalous SSH authentication patterns characterized by a high volume of failed logon attempts (>= 10) originating from a specific IP address within a short timeframe (30 minutes), followed by a successful authentication to the same target device. This pattern is indicative of a successful credential brute-force or password guessing attack against an exposed SSH service.
Detects anomalous authentication behavior indicative of an Adversary-in-the-Middle (AiTM) phishing kit. The rule identifies multiple password submission attempts (failures) followed by a successful authentication within a short period, consistent with an attacker testing multiple harvested credentials against an active session.
Detects successful authentication events using known default or low-privileged Cisco Firepower Management Center (FMC) service accounts, or IDS alerts (Snort SID 66883) associated with credential abuse activity potentially related to CVE-2026-20316.
This rule detects high-frequency account and email address enumeration attempts. It monitors syslog data for SMTP commands such as VRFY, EXPN, or RCPT TO, and analyzes Microsoft Entra ID (SigninLogs) for authentication failures specifically associated with error code 50034 (user not found). Both behaviors are indicative of an adversary attempting to validate user identities within an environment, often as a precursor to targeted phishing or brute-force attacks.
Detects successful authentication events using known default or low-privileged Cisco Firepower Management Center (FMC) service accounts, or IDS alerts (Snort SID 66883) associated with credential abuse activity potentially related to CVE-2026-20316.
Detects a pattern of multiple failed authentication attempts (brute force) from an external IP address followed by a successful authentication event on remote access services such as RDP, VPN, or NTLM. The rule filters for non-private IP addresses and flags successes occurring outside of standard business hours.
Detects high-frequency login attempts using the Dahua Easy4IP protocol. The rule flags multiple login opcode requests (identified by specific byte patterns 0xFF followed by 0x00A0) originating from the same source within a 60-second window, which is indicative of an automated brute-force or credential-stuffing attack targeting vulnerable IoT devices.
Detects anomalous authentication behavior indicative of an Adversary-in-the-Middle (AiTM) phishing kit. The rule identifies multiple password submission attempts (failures) followed by a successful authentication within a short period, consistent with an attacker testing multiple harvested credentials against an active session.
Detects a pattern of multiple failed authentication attempts (brute force) from an external IP address followed by a successful authentication event on remote access services such as RDP, VPN, or NTLM. The rule filters for non-private IP addresses and flags successes occurring outside of standard business hours.
This rule detects high-frequency account and email address enumeration attempts. It monitors syslog data for SMTP commands such as VRFY, EXPN, or RCPT TO, and analyzes Microsoft Entra ID (SigninLogs) for authentication failures specifically associated with error code 50034 (user not found). Both behaviors are indicative of an adversary attempting to validate user identities within an environment, often as a precursor to targeted phishing or brute-force attacks.
Detects anomalous authentication behavior indicative of an Adversary-in-the-Middle (AiTM) phishing kit. The rule identifies multiple password submission attempts (failures) followed by a successful authentication within a short period, consistent with an attacker testing multiple harvested credentials against an active session.
Detects ten or more Microsoft Entra sign-in failures for the same user from the same source IP within a five-minute window, identifying potential password guessing (brute force) activity against a single account.
This rule detects successful SSH logins that follow a burst of at least 10 failed SSH authentication attempts from the same remote IP address to the same device within a 10-minute window, followed by a successful login within 15 minutes. This pattern is indicative of a successful credential brute-force attack, frequently associated with botnet propagation efforts.
Detects instances where an administrator account experiences multiple authentication failures within a 15-minute window, followed by a successful authentication attempt from the same client IP address. This pattern is indicative of potential brute force or password spraying activity where the attacker successfully guessed the credentials after multiple failed attempts.
Detects instances where an administrator account experiences multiple authentication failures within a 15-minute window, followed by a successful authentication attempt from the same client IP address. This pattern is indicative of potential brute force or password spraying activity where the attacker successfully guessed the credentials after multiple failed attempts.
This rule detects repeated ZTNA/ZPA session restore failures for a single user within a short timeframe (15 minutes). A high number of session restore failures can indicate potential brute force attempts, token manipulation, or automated abuse of session management mechanisms.
Detects high-frequency failed sign-in attempts (10+ failures in 15 minutes) targeting the Okta Admin Console. The rule filters out common expected failure modes such as password expiration, account lockouts, and known helpdesk account activity to prioritize potential brute-force or credential-stuffing attacks against privileged administrative accounts.
Page 3 of 15