Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,064 detections
Filters
Last updated
All Time
Detection languages
597
173
103
71
51
Contributors
184
155
139
90
73
Categories
20,443
11,831
5,875
5,151
4,864
1,064
Platforms
575
266
228
223
118
Products / Services
498
220
130
118
86
MITRE Techniques
488
451
363
349
341
CVEs
10
5
4
3
2
IDS Classtypes
34
3
2
2
1
IDS Protocols
29
9
1
Detects automated credential stuffing with high-volume login attempts
Detects brute force attacks against IMAP email accounts
Detects password spraying attacks targeting LDAP for domain accounts
This rule detects a high volume of POST requests to login, authentication, or password-related URI stems within a 5-minute window from unique IP addresses. This behavior is indicative of brute-force attacks or credential stuffing attempts against web applications.
This rule detects suspicious device registration operations in a tenant by identifying device names that match known automated device code phishing kit patterns. Specifically, it looks for device names that are in the format of 'DESKTOP-' followed by 6 to 8 hexadecimal characters, which deviates from typical Windows default naming conventions. This pattern is often used by attackers to register devices for persistence or to bypass MFA.
This rule detects and summarizes Kerberos authentication ticket requests (EventID 4765) and Kerberos authentication ticket request failures (EventID 4766) by subject username on an hourly basis. A high volume of these events for a single user could indicate credential stuffing, brute-force attempts, or other authentication-related anomalies.
This rule detects potential lateral movement activity by identifying a single user account attempting to log on to five or more distinct computers with at least ten logon attempts within a five-minute window. It specifically looks for successful logons (EventID 4624) with network, remote interactive, or remote desktop logon types (LogonType 3, 9, 10) and excludes machine accounts (TargetUserName not ending with '$'). This pattern can indicate an adversary attempting to spread across the network using compromised credentials.
This rule detects suspicious activity related to Azure AD device registration. It identifies instances where a single user principal name (UPN) performs 5 or more device registrations or adds members to groups within a one-hour window, specifically targeting device resources. This could indicate an adversary attempting to register multiple devices to bypass conditional access policies or gain persistent access.
This rule detects potential GitHub token theft or abuse activity by identifying GitHub tokens that are used from an unusually high number of distinct IP addresses or for an unusually high number of uses within a one-hour window. Specifically, it looks for tokens with more than 5 uses and more than 2 distinct IP addresses in an hour. This behavior could indicate that a compromised token is being used by an attacker from multiple locations or in an automated fashion.
This rule detects multiple WinRM authentication attempts using basic authentication from a single source IP address to the local network. It specifically looks for the 'Authorization: Basic' header in TCP traffic destined for port 5985 (default WinRM port) and triggers an alert if five such attempts occur within 30 seconds from the same source.
This rule detects attempts to log in to a Telnet server using the default credential 'admin'. It specifically looks for the string 'admin' in TCP traffic directed to the HOME_NET on port 23 (Telnet). A threshold of 3 attempts within 30 seconds from the same source IP triggers the alert, indicating a potential brute-force or default credential attack.
This rule detects the use of a Silver Ticket for SMB service authentication. A Silver Ticket is a forged Kerberos service ticket that allows an attacker to authenticate to a specific service (like SMB) on a specific server without needing to interact with the Domain Controller. The rule looks for TCP traffic on port 445 (SMB) containing both 'NTLMSSP' and 'KRB5' content, indicating a Kerberos authentication attempt that might be a Silver Ticket. A threshold is applied to prevent excessive alerts.
This rule detects a high volume of remote desktop session changes (logon/logoff) for a single user within a one-hour window. Event IDs 4778 and 4779 indicate a session reconnected or disconnected, respectively. A high count (>=10) could suggest suspicious activity such as session hijacking, rapid reconnections by an attacker, or automated tools interacting with remote sessions.
This rule detects repeated attempts to use privileges for access checks (EventID 4673) by a single user within a one-hour window, excluding the 'SeTrustedCredentialManagerAccessPrivilege'. A high count of such events (5 or more) could indicate an attempt at privilege escalation or unusual system access behavior.
This rule detects potential Kerberos authentication abuse related to cross-domain trusts. It specifically looks for TCP traffic on port 88 (Kerberos) to the home network, containing the byte '6b' at the first position of the payload. A threshold of 20 occurrences within 10 seconds from the same source IP is set to trigger an alert, indicating a potential brute-force or rapid authentication attempt.
This rule detects RDP login attempts from an external network to the internal network. It specifically looks for the RDP protocol header (0x03 0x00) on TCP port 3389. A threshold of 5 attempts within 60 seconds from the same source IP is set to reduce false positives.
This rule detects potential lateral movement attempts using alternate authentication material, specifically NTLMSSP, over SMB (port 445). It triggers an alert if five or more NTLMSSP authentications are observed from a single source IP address to the home network within a 30-second window. This behavior can indicate an attacker attempting to authenticate to multiple systems using stolen credentials or hashes.
This rule detects a rapid succession of HTTP POST requests to a URI containing 'login' from the same source IP address, indicating a potential credential stuffing or brute-force attack. It triggers an alert if 20 such attempts occur within a 30-second window.
This rule detects and summarizes Kerberos authentication ticket requests (EventID 4765) and Kerberos authentication ticket request failures (EventID 4766) by subject username on an hourly basis. A high volume of these events for a single user could indicate credential stuffing, brute-force attempts, or other authentication-related anomalies.
This rule detects an unusually high volume of logon events (both successful and failed) or a large number of unique users attempting to log on within a 5-minute window. This behavior is indicative of potential brute-force attacks or credential stuffing attempts against Windows systems.
This rule detects potential lateral movement activity by identifying a single user account attempting to log on to five or more distinct computers with at least ten logon attempts within a five-minute window. It specifically looks for successful logons (EventID 4624) with network, remote interactive, or remote desktop logon types (LogonType 3, 9, 10) and excludes machine accounts (TargetUserName not ending with '$'). This pattern can indicate an adversary attempting to spread across the network using compromised credentials.
Page 29 of 51