Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
304 detections
Filters
Last updated
All Time
Detection languages
161
41
35
31
16
Contributors
117
32
24
22
21
Categories
195
89
66
58
57
Platforms
112
82
58
58
26
Products / Services
67
46
45
44
42
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
CVEs
5
2
2
2
1
IDS Classtypes
35
3
2
1
1
IDS Protocols
37
3
1
1
Identifies a local device repeatedly attempting to access default router gateway IPs (192.168.1.1, 192.168.0.1, 10.0.0.1) on common web ports (80, 443) to brute-force admin passwords. The rule triggers if more than 20 attempts are observed within a one-minute window from a single device to a specific remote IP.
Monitors for the use of 'sshpass' to automate SSH logins, specifically targeting accounts commonly associated with Oracle/PeopleSoft administration (psoft, oracle, linuxadm) and bypassing strict host key checking. This technique has been observed in ShinyHunters attacks for lateral movement.
This rule detects potential SSH brute force attacks by identifying multiple failed password attempts from a single source IP address to a specific computer within a 5-minute window. It specifically looks for 'Failed password' messages in syslog entries from the 'sshd' process.
This rule detects multiple failed SSL login attempts from a single source IP to a destination IP within a 24-hour period. A threshold of 10 failed attempts is used to identify potential brute-force attacks or credential stuffing against SSL-enabled services.
Monitors for the use of 'sshpass' to automate SSH logins, specifically targeting accounts commonly associated with Oracle/PeopleSoft administration (psoft, oracle, linuxadm) and bypassing strict host key checking. This technique has been observed in ShinyHunters attacks for lateral movement.
Monitors for the use of 'sshpass' to automate SSH logins using specific accounts commonly associated with Oracle/PeopleSoft administration (psoft, oracle, linuxadm) with disabled strict host key checking. This technique was observed in ShinyHunters attacks.
Detects high-frequency failed logon attempts (Event ID 4625) from a single IP address within a short time window, indicating potential brute force or password spraying activity targeting Windows systems.
Sshpass Lateral Movement
YARA-L
Detects sshpass automation usage by administrative accounts
Monitors for the use of 'sshpass' to automate SSH logins using specific accounts commonly associated with Oracle/PeopleSoft administration (psoft, oracle, linuxadm). This technique was observed in ShinyHunters attacks.
Monitors for the use of 'sshpass' to automate SSH logins using specific accounts commonly associated with Oracle/PeopleSoft administration (psoft, oracle, linuxadm). This technique was observed in ShinyHunters attacks.
Detects repeated authentication failures (Event ID 4625) with a specific sub-status code 0xC0000072, which indicates that the user account is disabled. This behavior is indicative of a brute-force or credential-stuffing attack against disabled accounts, or potentially misconfigured automated services attempting to authenticate with stale credentials.
This rule detects multiple failed logon attempts (more than 5 within a 5-minute window) for user accounts from a single IP address. This behavior is indicative of a brute-force attack or password guessing attempt against user accounts.
Detects multiple TCP synchronization (SYN) packets targeting the SSH service (port 22) from a single source IP address within a short timeframe. This behavior is indicative of a brute-force or credential-guessing attack against the SSH service.
This rule detects multiple Network Level Authentication (NLA) negotiation attempts targeting port 3389 from a single source within a 60-second window, which is indicative of an RDP brute-force attack.
This rule detects potential brute force attacks against Active Directory accounts by identifying multiple failed login attempts (EventID 4625) from the same IP address to the same account within a short time frame (10 failed attempts within 10 minutes).
Detects multiple failed connection attempts to Azure Database for MySQL, which may indicate a brute force attack. This rule specifically looks for 'Access Denied' errors (error code 1045) or other non-zero error codes during connection attempts within a defined timeframe from the same client IP address.
Detects high-frequency failed network logon attempts (Logon Type 3) originating from a single IP address. This behavior is indicative of password guessing or password spraying activity against network services.
Detects a potential brute force or password spraying attempt by identifying high volumes of NTLM logon failures (Event ID 4625) originating from a single IP address, targeting multiple distinct user accounts within a 10-minute window.
Detects high-frequency failed network logon attempts (Logon Type 3) originating from a single IP address. This behavior is indicative of password guessing or password spraying activity against network services.
Detects anomalous authentication failure patterns against Azure AD Service Principals from a single IP address. The rule identifies potential brute force attacks (high volume of failures) or service principal enumeration (multiple distinct service principals targeted).
Detects high-frequency authentication failure events targeting multiple unique user accounts from the same source IP address within a 10-minute window. This behavior is indicative of password spraying or credential stuffing attacks against Azure Active Directory (Microsoft Entra ID). The rule specifically monitors for common error codes related to incorrect passwords or account lockout conditions.
Page 8 of 15