Rajuaravind Sankar
@rajuaravindxCompletionist
0 followers72 downloads28 copies1 like972 views
4 detections
Filters
Last updated
All Time
Detection languages
4
Categories
2
1
1
1
1
Platforms
3
Products / Services
2
1
1
1
1
MITRE Techniques
1
1
1
1
1
CVEs
1
1
1
This rule detects the use of common file transfer and remote access protocols (SSH, FTP, SMB, TELNET, FTPS, SMB.v3) communicating over non-standard ports. Adversaries often use non-standard ports to bypass firewall rules, evade detection, or obscure their command and control (C2) traffic. The rule specifically excludes the standard ports for these protocols to focus on anomalous behavior.
This rule detects a high number of failed authentication attempts followed by a successful authentication from the same source IP address and user. It specifically looks for events categorized as 'Insecure_Authentication' within the 'Authentication' datamodel. The rule aggregates authentication events by source IP, user, destination, application, caller user name, target user name, logon type, event code, signature, tag, action, authentication method, authentication service, vendor product, and user priority. It then filters for scenarios where there are more than 5 failures and more than 1 success for the same aggregated criteria.
Identify Suspicious Admin Activity in F5 BIG IP
Triggers when more than 5 failed login detected in one hour time span. set rule to run every 60mins