Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
280 detections
Filters
Last updated
All Time
Detection languages
154
55
25
13
13
Contributors
55
55
49
33
12
Categories
190
96
90
68
45
Platforms
118
89
61
48
41
Products / Services
111
64
36
25
19
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
5
2
2
IDS Classtypes
11
2
1
IDS Protocols
10
3
This rule detects external brute-force attempts against firewall authentication mechanisms. It triggers when 15 or more failed login attempts from a single external IP address occur within a 15-minute window. The rule specifically filters for 'USER_LOGIN' events with a 'BLOCK' or 'FAIL' security result and excludes internal RFC1918 IP addresses to focus on external threats.
https://blog.checkpoint.com/research/iran-nexus-password-spray-campaign-targeting-cloud-environments-with-a-focus-on-the-middle-east/
Detects potential password spray activity by identifying a single IP address generating failed sign-ins across multiple distinct user accounts within a short window. This rule specifically looks for '50126' result type, indicating an invalid username or password, from a single IP address attempting to authenticate against at least 5 distinct user accounts within a 10-minute window.
This rule detects password spraying attacks where a single IP address attempts to authenticate against multiple unique user accounts within a specified time window, resulting in failed sign-in attempts. It specifically looks for a high number of unique users failing authentication from the same IP, which is characteristic of password spraying to avoid account lockouts.
Detects successful brute force attacks: 10+ login failures within 10 minutes followed by successful login within 1 hour, excluding trusted networks and whitelisted accounts
This alert finds sessions where a device-code flow produced multiple sign-in events (interactive + non-interactive), with mismatched user-agents or differing country/geolocation, for the same Session ID - a strong indicator of device-code phishing abuse.
Looks for:
Brute-forcing device code tokens
Token replay attempts
Malicious use of device code authentication across different devices or locations
Anomalous sign-in behaviour suggesting account compromise
Looks for:
Brute-forcing device code tokens
Token replay attempts
Malicious use of device code authentication across different devices or locations
Anomalous sign-in behaviour suggesting account compromise
Detects successful authentication attempts originating from clients using legacy authentication methods, identifiable via specific user agent strings. This activity can indicate an adversary attempting to bypass multi-factor authentication (MFA), potentially as part of a password spray attack. Legacy authentication protocols often do not support modern MFA mechanisms, making them a target for attackers who have obtained valid credentials through other means or are performing brute-force attacks like password spraying.
Researching about how to classify ISP based on different factors, I created a query based on ISP sign-in attempts.
This rule detects multiple failed SSL login attempts from a single source IP to a destination IP within a 24-hour period. A threshold of 10 failed attempts is used to identify potential brute-force attacks or credential stuffing against SSL-enabled services.
The following analytic detects potential distributed password spraying attacks in an Azure AD environment. It identifies a spike in failed authentication attempts across various user-and-IP combinations from multiple source IPs and countries, using different user agents. This detection leverages Azure AD SignInLogs, focusing on error code 50126 for failed authentications. This activity is significant as it indicates an adversary's attempt to bypass security controls by distributing login attempts. If confirmed malicious, this could lead to unauthorized access, data breaches, privilege escalation, and lateral movement within the organization's infrastructure.
Password Spray Using Kerberos Pre-Auth
Cortex XDR
This query detects Kerberos pre-authentication attempts where the captured source address is external.
You can tweak and remove the RFC's to also look at internal requests, but expect some noise.
In addition, you might want to tweak the counter.
You can tweak and remove the RFC's to also look at internal requests, but expect some noise.
In addition, you might want to tweak the counter.
KQL Query from file: Threat Hunt: Potential Password Spray Attacks
KQL Query from file: Azure Cloud Security Monitoring
KQL Query from file: Password Spraying Detection in Active Directory
KQL Query
KQL Query
KQL Query from file: Exploring M365 Accounts Investigation
KQL Query
KQL Query from file: MailItemsAccessed Defense
KQL Query from file: Azure Cloud Security Monitoring
KQL Query from file: Multi-Cloud DefenderXDR KQL Threat Detection
Page 10 of 14