Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,931
7,261
6,535
3,864
3,642
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
This rule detects the creation of a new API token within the Okta identity platform. API tokens can be used for programmatic access to Okta and, if compromised, can lead to unauthorized access, persistence, or privilege escalation. The rule specifically looks for 'system.api_token.create' events with a successful 'ALLOW' action.
This rule detects suspected password spraying attacks identified by Okta's ThreatInsight. It specifically looks for Okta security events categorized as 'Password Spray' and can additionally increase the risk score if the originating IP address is marked as suspicious by Okta ThreatInsight or if the login attempt originates from certain unauthorized geographies (Cuba, Iran, North Korea, Russia, Syria).
This rule detects when a user is assigned 'Super user' privileges within the OneLogin SSO system. It specifically looks for events where the event type is 'USER_CHANGE_PERMISSIONS', the product is 'ONELOGIN_SSO', the vendor is 'ONELOGIN', the product event type indicates a permission grant (code 72), and the target resource name is 'Super user'. This indicates a significant privilege escalation within the identity provider.
This rule detects when a user in OneLogin reveals another user's application password. This is identified by monitoring 'USER_RESOURCE_ACCESS' events from 'ONELOGIN_SSO' where the product event type is '240' (indicating an actor user revealed a password to an app for another user) and the principal user ID is different from the target user ID. This scenario suggests unauthorized access or disclosure of credentials.
This rule detects a successful OneLogin login event that is preceded by multiple failed One-Time Password (OTP) attempts within a 15-minute window for the same user. Specifically, it looks for at least four failed OTP challenges followed by a successful OTP verification and then a successful user login. This pattern is indicative of an OTP brute-force attack where an attacker is attempting to guess the correct OTP.
This rule detects targeted brute-force attacks against an Okta organization. It specifically looks for events from Okta ThreatInsight where known malicious IPs are attempting to access a specific user account, indicated by multiple failed authentication attempts for the same user within a one-hour window. The rule leverages Okta's security.attack.start event type to identify these activities.
This rule detects when a single user account (principal) assumes the identity of multiple other user accounts (targets) within the OneLogin SSO system. Specifically, it triggers if a user, identified by their `userid`, performs "USER_RESOURCE_ACCESS" events as more than 3 distinct target users within a one-hour window. This behavior can indicate an attacker attempting to gain access to multiple accounts after compromising a single set of credentials, or an insider abusing their privileges.
Detects when a user removes an authentication factor or OTP device within OneLogin. This action can weaken security by removing a layer of multi-factor authentication, potentially making the account more vulnerable to compromise.
This rule detects successful user authentications to Okta that occur outside of typical business hours or on weekends. It specifically flags logins on Saturdays and Sundays, and logins between 8 PM and 7 AM UTC on weekdays. The rule calculates a risk score based on the day and time of the login, with higher scores for weekend logins and late-night/early-morning logins.
This rule detects suspicious user login activity where a single user attempts to log in from multiple distinct countries within a 24-hour period. This behavior can indicate a compromised account being used by an attacker from a different geographic location than the legitimate user, or a user attempting to bypass security controls. The rule also assigns a higher risk score if the login originates from specific high-risk countries (Cuba, Iran, North Korea, Russia, Syria).
Detects when an excessive number of permissions are assigned to an Entra ID application within a time window, potentially indicating a greedy permission grab, as a numeric value comparing old permissions to new permissions
Identifies when a Google Workspace user downloads a file from Google Drive after a suspicious login event occurred.
Identifies when Google Workspace password policy is changed. Security teams can monitor for changes to password policy configuration that may weaken the organization's security posture.
Okta provides a platform detection for when a user enrolled in FastPass fails to authenticate via a real-time AiTM phishing proxy.
Okta ThreatInsight detects access requests from known malicious IPs targeting a specific org.
Detects user logins for same user from different cities within 24 hours.
Detects when a user removes an authentication factor or otp device.
Identifies when a user sends multiple files from Google Drive as an email attachment to a free email domain, which may indicate data exfiltration.
Identifies when a user account is unsuspended in Google Workspace.
Detects when an excessive number of permissions are assigned to an Entra ID application within a time window, potentially indicating a greedy permission grab, as a percentage from old permissions to new permissions
Detects multiple user logins with invalid credentials from a single IP.
Page 140 of 142