Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
132 detections
Filters
Last updated
All Time
Detection languages
77
17
11
10
8
Contributors
37
23
15
12
11
Categories
102
55
42
38
20
Platforms
52
30
30
28
14
Products / Services
47
16
16
14
12
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
2
IDS Classtypes
4
3
2
1
1
IDS Protocols
6
4
1
This rule detects multiple login failures from the same IP address targeting unknown users, as identified by Okta's ThreatInsight. It specifically looks for Okta events categorized as 'USER_UNCATEGORIZED' and 'security.threat.detected' with a summary indicating 'Login failures with high unknown users count'. The rule also incorporates risk scoring based on whether the IP address is deemed suspicious by Okta ThreatInsight and if the login attempts originate from certain high-risk countries.
This rule detects multiple failed login attempts from different users originating from the same IP address within a one-hour window in Okta. It specifically looks for events where the login attempt was blocked due to invalid credentials. The rule also incorporates risk scoring based on Okta ThreatInsight detections and behavioral patterns like new geo-location, device, or IP, as well as logins from unauthorized geographies (Cuba, Iran, North Korea, Russia, Syria). The detection is triggered if more than 5 distinct user IDs attempt to log in with invalid credentials from the same IP within the specified timeframe.
This rule detects multiple failed login attempts from different users originating from the same IP address within a one-hour window in OneLogin. It specifically looks for 'USER_LOGIN' events with a 'BLOCK' security result and a product event type of '6' (user failed authentication). The rule also calculates a risk score, which is increased if the originating IP address is from certain unauthorized geographies (Cuba, Iran, North Korea, Russia, Syria). This behavior is indicative of potential brute-force attacks or credential stuffing attempts against multiple user accounts from a single source.
Detects when a high number of failed authentication attempts happen for unknown users.
Detects unusual number of failed authentications from the same IP for valid users.
Identifies user accounts that have been locked due to multiple failed sign-in attempts with incorrect credentials. This often indicates a brute-force attack or password guessing attempt against user accounts.
Page 7 of 7