Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
280 detections
Filters
Last updated
All Time
Detection languages
154
55
25
13
13
Contributors
55
55
49
33
12
Categories
190
96
90
68
45
Platforms
118
89
61
48
41
Products / Services
111
64
36
25
19
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
5
2
2
IDS Classtypes
11
2
1
IDS Protocols
10
3
Detects high-frequency password reset or credential recovery attempts originating from a single source IP against multiple user accounts. This behavior is indicative of an automated enumeration or brute-force attack, potentially exploiting vulnerabilities such as the referenced CVE-2026-18963.
This rule correlates Microsoft Entra ID (formerly Azure AD) risk events identified as 'passwordSpray' with subsequent sign-in logs from the same source IP address within a 60-minute window. This helps identify successful or suspicious authentication activity originating from an IP address previously flagged for password spraying attempts against a specific user account.
Detects high-frequency password reset or credential recovery attempts originating from a single source IP against multiple user accounts. This behavior is indicative of an automated enumeration or brute-force attack, potentially exploiting vulnerabilities such as the referenced CVE-2026-18963.
Detects high-frequency login attempts using the Dahua Easy4IP protocol. The rule flags multiple login opcode requests (identified by specific byte patterns 0xFF followed by 0x00A0) originating from the same source within a 60-second window, which is indicative of an automated brute-force or credential-stuffing attack targeting vulnerable IoT devices.
This rule detects potential password spraying activity by monitoring Microsoft Entra sign-in logs for multiple failed authentication attempts originating from the same source IP address targeting ten or more distinct user accounts within a ten-minute time window.
Detects potential password spraying activity characterized by a high number of distinct IP addresses failing authentication for a specific user, followed shortly by a successful authentication for that same user from a geographic location outside the United Kingdom.
This rule detects a potential password spraying attack followed by a successful sign-in from a non-UK location. It monitors for a threshold of failed sign-in attempts from distinct source IPs for a specific user within a 4-hour window, followed by a subsequent successful sign-in event from a different geographical location.
Detects potential password spraying or brute force activity against Entra ID by monitoring for a high number of failed authentication attempts from a single IP address targeting multiple unique user accounts within a 15-minute window.
Detects high volumes of authentication failures within Okta, characterized by a single source IP address targeting a large number of distinct user accounts. This behavior is indicative of automated credential attacks, such as password spraying or credential stuffing, designed to discover valid credentials or exploit reused passwords while attempting to evade account lockout thresholds.
Detects high-frequency Resource Owner Password Credentials (ROPC) authentication attempts originating from a single IP address against multiple different user accounts within a 15-minute window. This behavior is indicative of a password spraying or brute force campaign targeting cloud authentication services.
Detects high-frequency authentication attempts or broad user targeting originating from scripts using the 'python-requests' library. This behavior is indicative of programmatic password spraying or automated credential stuffing attacks.
Detects high volumes of sign-in failures originating from the same IP address, specifically those returning error codes associated with invalid users or incorrect passwords, which is indicative of credential stuffing or user enumeration attacks targeting Entra ID.
Detects high-volume, anomalous authentication failure patterns originating from a single IP address, characterized by a large number of distinct applications and users accessed within a one-hour window. This is indicative of potential automated credential-based attacks such as password spraying or brute force.
Detects high volumes of authentication failures (AADSTS50034) targeting non-existent or invalid usernames from a single source IP address, potentially indicating account enumeration or password spraying activity.
Detects multiple authentication failure attempts (error code 700016: Application not found in directory) originating from the same IP address against multiple user accounts. This pattern is indicative of an adversary attempting to find or exploit service principals or misconfigured applications across the tenant.
Detects login attempts using an Outlook/Office-specific User-Agent string where the application being accessed does not match common Microsoft 365 services (Outlook, Office, Exchange, Teams, OneDrive, SharePoint, ActiveSync, or Skype). This pattern is often indicative of programmatic attempts to bypass or spoof standard application signatures during credential stuffing or brute force campaigns.
Detects anomalous authentication patterns originating from a single IP address where multiple users are targeted. The rule specifically monitors for a combination of error codes (50034 - User not found, 50126 - Invalid credentials, 700016 - Multi-factor authentication required) to identify potential password spraying or brute force activity targeting Microsoft Entra ID (formerly Azure AD).
Detects potential credential harvesting or account enumeration activity by identifying successful enumeration of user accounts (via specific sign-in result codes) followed by a spike in account lockouts for the same users within a 60-minute window. This behavior is indicative of an attacker verifying valid accounts before launching a targeted brute force or credential stuffing campaign.
Detects high-frequency failed logon attempts (>= 6) against accounts with administrative naming conventions within a 3-minute window. The rule specifically flags activity targeting multiple distinct destination hosts, which is a strong indicator of lateral movement or account brute-forcing/spraying attempts across an enterprise network.
Detects Microsoft Entra authentication events using the Resource Owner Password Credentials (ROPC) grant type where the User-Agent string explicitly identifies as a Microsoft Outlook desktop client. Adversaries often spoof these User-Agent strings in OAuth client ID campaigns to bypass conditional access policies or appear as legitimate traffic during automated login attempts.
This rule detects potential password spraying or brute-force activity by monitoring Azure Sign-in logs for a high volume of failed authentication attempts (error code 50126) originating from a single IP address across multiple distinct user accounts.
Page 6 of 14