Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
128 detections
Filters
Last updated
All Time
Detection languages
45
44
17
10
5
Contributors
43
25
15
10
9
Categories
54
43
33
27
23
Platforms
105
13
7
3
3
Products / Services
10,660
9,755
6,689
4,418
3,748
MITRE Techniques
56
49
43
35
33
CVEs
3
3
3
1
1
IDS Classtypes
7
3
IDS Protocols
10
Detects the use of NTLMv1 for authentication between a client and server. NTLMv1 is an insecure authentication protocol due to its susceptibility to brute-force attacks against its underlying encryption algorithms. This rule identifies events logged by the LsaSrv provider indicating NTLMv1 usage.
NTLM Brute Force
Sigma
Detects common NTLM brute force device names
Page 7 of 7