Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,065 detections
Filters
Last updated
All Time
Detection languages
598
173
103
71
51
Contributors
184
155
139
90
73
Categories
20,453
11,837
5,876
5,154
4,865
1,065
Platforms
576
266
228
223
118
Products / Services
499
220
130
118
86
MITRE Techniques
488
451
364
349
341
CVEs
10
5
4
3
2
IDS Classtypes
34
3
2
2
1
IDS Protocols
29
9
1
This rule detects potential lateral movement activity by identifying a single user account attempting to log on to five or more distinct computers with at least ten logon attempts within a five-minute window. It specifically looks for successful logons (EventID 4624) with network, remote interactive, or remote desktop logon types (LogonType 3, 9, 10) and excludes machine accounts (TargetUserName not ending with '$'). This pattern can indicate an adversary attempting to spread across the network using compromised credentials.
This rule detects suspicious Azure AD sign-in activity where a user successfully signs in from multiple unusual cities within a 24-hour period. It specifically looks for sign-ins that are not from a trusted network and are not from a compliant device, aggregating successful sign-ins by UserPrincipalName and IpAddress, and flagging if there are 5 or more distinct cities.
This rule detects suspicious NTLM network or remote interactive logon activity. It specifically looks for multiple distinct accounts logging in from the same device and remote IP address within a one-hour window, using NTLM authentication via NtLmSsp or Seclogon processes. This pattern can indicate credential stuffing, NTLM relay attacks, or other forms of credential misuse.
Detects both specific Indicators of Compromise (IOCs) and generic anomalous authentication activity associated with the exploitation of the PAN-OS GlobalProtect authentication bypass vulnerability (CVE-2026-0257).
This rule detects potential credential stuffing or password spraying attacks against Okta by monitoring for a high volume of failed primary authentication attempts from a single source IP address or ASN within a one-hour window. It also incorporates corroborating evidence such as account lockouts, Okta ThreatInsight detections, and blocked requests. The rule surfaces both failed attempts and successful logins that might indicate a compromised account.
This rule detects an anomaly in Kerberos authentication attempts by monitoring TCP traffic to port 88 (Kerberos). It triggers an alert if a source IP address attempts Kerberos authentication 30 or more times within a 10-second window, indicating a potential brute-force or rapid authentication attempt against a domain account.
This rule detects attempts to log in to a web interface using default 'admin' credentials. It specifically looks for HTTP POST requests to a URI containing 'login' and a client body that contains 'admin' twice, indicating both username and password might be 'admin'.
Detects credential stuffing attacks targeting account takeover for infrastructure abuse
This rule detects potential session hijacking or token replay attacks against Okta by identifying a single Okta session (externalSessionId) being used from multiple distinct origins. It specifically looks for divergence in client country, device hash (dtHash), or operating system within the same session, rather than just multiple IP addresses, to reduce false positives. This behavior is indicative of a stolen post-MFA cookie being replayed by an attacker.
This rule detects a high volume of POST requests to login, authentication, or password-related URI stems within a 5-minute window from unique IP addresses. This behavior is indicative of brute-force attacks or credential stuffing attempts against web applications.
Detects generic anomalous authentication or unexpected session creation indicative of an authentication bypass vulnerability (CVE-2026-0257) in PAN-OS GlobalProtect. Needs specific endpoint/URI tuning based on actual CVE details once available.
This rule detects potential credential abuse of service principals or applications by identifying an unusual number of activities from a single service principal or application across multiple distinct IP addresses within a one-hour window. It specifically monitors sign-in logs for applications like 'Azure CLI', 'GitHub', or 'CustomApp' where the user type is 'ServicePrincipal' or 'Application'. A threshold of more than 10 activities and more than 2 distinct IP addresses within an hour triggers an alert.
This rule detects a suspicious sequence of events in Okta that could indicate a help-desk social engineering attack or account takeover. Specifically, it looks for a user's password being reset, followed by the enrollment of a new MFA factor or device for that same user, all occurring within a short time frame (1 hour) and potentially from distinct session IDs or device hashes. This pattern suggests an attacker has gained initial access (e.g., via social engineering the help desk) and is immediately attempting to establish persistence by enrolling their own MFA device.
This rule detects suspicious device enrollment attempts via Microsoft Intune Company Portal from a country not previously observed in a user's 7-day sign-in history. It identifies two primary patterns: sustained successful sign-ins from a new country, indicating a potential active session and successful device enrollment (High Severity), or Conditional Access Policy (CAP) blocked attempts from a new country, suggesting an attacker probing with stolen credentials (Medium Severity). The detection aims to identify identity theft leading to unauthorized device enrollment.
This rule detects suspicious Azure AD sign-in activity where a user successfully signs in from multiple unusual cities within a 24-hour period. It specifically looks for sign-ins that are not from a trusted network and are not from a compliant device, aggregating successful sign-ins by UserPrincipalName and IpAddress, and flagging if there are 5 or more distinct cities.
Detects suspicious activity involving multiple password resets for different users initiated by a single user within a one-hour timeframe in Azure AD. This could indicate an attacker attempting to gain control over multiple accounts.
This rule detects potential credential abuse of service principals or applications by identifying an unusual number of activities from a single service principal or application across multiple distinct IP addresses within a one-hour window. It specifically monitors sign-in logs for applications like 'Azure CLI', 'GitHub', or 'CustomApp' where the user type is 'ServicePrincipal' or 'Application'. A threshold of more than 10 activities and more than 2 distinct IP addresses within an hour triggers an alert.
This rule detects a potential account takeover attempt via a credential stuffing attack. It specifically looks for HTTP POST requests to a URI containing 'login' (case-insensitive) from a single destination IP address, with a high frequency (50 requests within 60 seconds). This pattern suggests an automated attempt to try multiple credentials against a login endpoint.
This rule detects multiple login attempts to social media platforms (Twitter, X, Instagram, Facebook) from a single source IP address within a short timeframe. It specifically looks for HTTP POST requests to URIs containing 'login' on these domains. A threshold of 10 attempts within 30 seconds triggers the alert, indicating a potential brute-force or credential stuffing attack aimed at hijacking social media accounts.
This rule detects a brute force attempt against a cloud management console. It triggers when a source IP address makes 10 or more HTTP POST requests to a URI containing 'signin' within a 30-second window. This pattern is indicative of an automated attempt to guess credentials for a login page.
This rule detects RDP credential spraying attempts targeting multiple usernames on a single destination IP address. It triggers an alert if 30 or more RDP connection attempts are made to the same destination within a 60-second window, indicating a potential brute-force or credential-stuffing attack against RDP services.
Page 30 of 51