Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
172 detections
Filters
Last updated
All Time
Detection languages
55
54
47
9
3
Contributors
49
37
36
17
8
Categories
44
40
37
34
33
Platforms
142
15
11
10
7
Products / Services
10,643
9,755
6,688
4,418
3,745
MITRE Techniques
70
62
53
52
32
CVEs
1
1
1
IDS Classtypes
1
IDS Protocols
1
Okta's ThreatInsight can identify multiple login failures with high unknown users count from the same IP across one or more Okta orgs.
Detects when a user's account is locked out or a user account has reached the lockout limit.
Detects when an Okta user rejects more than 2 Push notifications in a 10 minute window.
This rule detects the creation or activation of new user accounts in Okta with specific display names, such as 'svc_network_backup', which were identified as indicators of compromise during the Okta Support System 2023 breach. It aims to flag suspicious account activity that could indicate unauthorized access or persistence by an attacker. The rule can be improved by filtering out legitimate usernames if 'svc_network_backup' is a known and authorized account in the environment.
Page 9 of 9