Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
280 detections
Filters
Last updated
All Time
Detection languages
154
55
25
13
13
Contributors
55
55
49
33
12
Categories
190
96
90
68
45
Platforms
118
89
61
48
41
Products / Services
111
64
36
25
19
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
5
2
2
IDS Classtypes
11
2
1
IDS Protocols
10
3
This analytic identifies a source endpoint failing to authenticate with multiple disabled domain users using the Kerberos protocol. It leverages Windows EventCode 4768, which is generated when the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT) and detects failure code `0x12` (credentials revoked). This behavior is significant as it may indicate a Password Spraying attack targeting disabled accounts, potentially leading to initial access or privilege escalation. If confirmed malicious, attackers could gain unauthorized access or elevate privileges within the Active Directory environment.
The analytic identifies a source user failing to authenticate with multiple users using explicit credentials on a host. It leverages Windows Event Code 4648 and calculates the standard deviation for each host, using the 3-sigma rule to detect anomalies. This behavior is significant as it may indicate a Password Spraying attack, where an adversary attempts to gain initial access or elevate privileges. If confirmed malicious, this activity could lead to unauthorized access, privilege escalation, or further compromise of the Active Directory environment.
The following analytic identifies a source process failing to authenticate multiple users, potentially indicating a Password Spraying attack. It leverages Windows Event 4625, which logs failed logon attempts, and uses statistical analysis to detect anomalies. This activity is significant as it may represent an adversary attempting to gain initial access or elevate privileges within an Active Directory environment. If confirmed malicious, the attacker could compromise multiple accounts, leading to unauthorized access, data exfiltration, or further lateral movement within the network.
The analytic identifies a source endpoint failing to authenticate multiple valid users using the NTLM protocol, potentially indicating a Password Spraying attack. It leverages Event 4776 from Domain Controllers, calculating the standard deviation for each host and applying the 3-sigma rule to detect anomalies. This activity is significant as it may represent an adversary attempting to gain initial access or elevate privileges. If confirmed malicious, the attacker could compromise multiple accounts, leading to unauthorized access and potential lateral movement within the network.
This rule detects suspected password spraying attacks identified by Okta's ThreatInsight. It specifically looks for Okta security events categorized as 'Password Spray' and can additionally increase the risk score if the originating IP address is marked as suspicious by Okta ThreatInsight or if the login attempt originates from certain unauthorized geographies (Cuba, Iran, North Korea, Russia, Syria).
This rule detects successful password spray activity. A password spray attack involves an adversary attempting a single or small list of commonly used passwords against many different accounts to acquire valid credentials, often to avoid account lockouts. The detection specifically triggers when Azure AD Identity Protection identifies a 'passwordSpray' risk event.
This rule detects potential password spraying attempts that leverage the built-in Windows utility `dsacls.exe`. Specifically, it looks for executions of `dsacls.exe` where the command line includes both the `/user:` and `/passwd:` arguments, indicating an attempt to bind to an LDAP session with specified credentials. This technique can be used by attackers to test a single password against multiple user accounts to avoid account lockouts.
Page 14 of 14