Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
782 detections
Filters
Last updated
All Time
Detection languages
431
116
112
63
22
Contributors
176
85
81
80
70
Categories
20,443
11,831
5,875
5,151
4,864
782
Platforms
340
223
141
138
71
Products / Services
319
167
85
57
50
MITRE Techniques
413
348
255
231
200
CVEs
5
5
3
2
2
IDS Classtypes
7
2
1
1
1
IDS Protocols
8
2
1
1
Detect failed attempts to sign in to disabled accounts.
Detects a login attempt in Google Workspace flagged as a potential attack by a government-backed threat actor
Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge.
Detect access has been blocked by Conditional Access policies.
The access policy does not allow token issuance which might be sights≈ of unauthorizeed login to valid accounts.
The access policy does not allow token issuance which might be sights≈ of unauthorizeed login to valid accounts.
Detects when Okta FastPass prevents a known phishing site.
This rule detects and monitors sign-in attempts to third-party Artificial Intelligence (AI) applications within an organization's environment. It identifies sign-ins to known AI vendors and tools by matching keywords in application display names and resource display names from Entra ID (formerly Azure AD) sign-in logs. The rule specifically excludes Microsoft's own Copilot products to focus on 'shadow AI' usage. It aggregates sign-in attempts, successes, failures, unique users, and common failure reasons to provide insights into the adoption and potential risks associated with unsanctioned AI tool usage.
Detects user authentication failure events.
Please note that this rule can be noisy and it is recommended to use with correlation based on "author.name" field.
Please note that this rule can be noisy and it is recommended to use with correlation based on "author.name" field.
Detects when an account is disabled or blocked for sign in but tried to log in
User has indicated they haven't instigated the MFA prompt and could indicate an attacker has the password for the account.
Detects when there is a interruption in the authentication process.
Detects BGP failures which may be indicative of brute force attacks to manipulate routing
Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels
Detects BGP failures which may be indicative of brute force attacks to manipulate routing.
Detects a failed logon attempt from a public IP. A login from a public IP can indicate a misconfigured firewall or network boundary.
Hacktool Ruler
Sigma
This events that are generated when using the hacktool Ruler by Sensepost
This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that have been disabled or somehow restricted.
Detects when a user has potentially entered their password into the
username field, which will cause the password to be retained in log files.
username field, which will cause the password to be retained in log files.
Detects multiple multi-factor authentication (MFA) attempts that are denied or ignored by a user beyond a defined threshold within a specific lookback window. This behavior is indicative of an MFA fatigue attack, where an adversary repeatedly sends MFA requests to a user in hopes they will eventually approve one to stop the annoyance.
https://blog.checkpoint.com/research/iran-nexus-password-spray-campaign-targeting-cloud-environments-with-a-focus-on-the-middle-east/
This rule detects multiple failed sign-in attempts using the 'Device Code' authentication flow from various IP addresses or locations for a single user. This behavior can indicate an adversary attempting to bypass multi-factor authentication (MFA) or gain unauthorized access through device code phishing or brute-force attacks against the device code flow. The rule specifically looks for more than 3 attempts from more than 2 distinct IP addresses or locations, targeting common Microsoft applications like Office, Teams, Azure Portal, or Graph.
This rule detects multiple failed authentication attempts for a single user from a specific source IP and host. This behavior can indicate a brute-force attack or password guessing attempt against user accounts.
Page 23 of 38