Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
782 detections
Filters
Last updated
All Time
Detection languages
431
116
112
63
22
Contributors
176
85
81
80
70
Categories
20,443
11,831
5,875
5,151
4,864
782
Platforms
340
223
141
138
71
Products / Services
319
167
85
57
50
MITRE Techniques
413
348
255
231
200
CVEs
5
5
3
2
2
IDS Classtypes
7
2
1
1
1
IDS Protocols
8
2
1
1
Detects a pattern indicative of an NTLM relay attack following an authentication coercion spray. The rule first identifies a single source IP generating a high volume of failed NTLM logon attempts across multiple critical servers in a short time. It then looks for a subsequent successful NTLM logon from that same source IP to a high-value target (like a Certificate Authority) using a machine account. This sequence is a strong indicator that an attacker coerced credentials and is now relaying them to escalate privileges.
This rule detects a high number of failed authentication attempts followed by a successful authentication from the same source IP address and user. It specifically looks for events categorized as 'Insecure_Authentication' within the 'Authentication' datamodel. The rule aggregates authentication events by source IP, user, destination, application, caller user name, target user name, logon type, event code, signature, tag, action, authentication method, authentication service, vendor product, and user priority. It then filters for scenarios where there are more than 5 failures and more than 1 success for the same aggregated criteria.
The purpose of this query is to identify accounts that have logged in from multiple different countries within a short time window (last hour or last day).
This is typically used for security monitoring to detect suspicious or anomalous authentication behavior.
This is typically used for security monitoring to detect suspicious or anomalous authentication behavior.
Query sign-ins with MFA success immediately following multiple failed sign-ins from different regions. Potential session hijack or AiTM (Adversary-in-the-Middle).
Error Code 0
Successful authentication
Normal successful login (validate carefully only when paired with suspicious failures)
Error Code 50053
Account locked or malicious IP
HIGH - Brute force attempts
Error Code 50074
MFA challenge not passed
HIGH - User failed MFA
Error Code 500121
MFA prompt timeout
MEDIUM - Possible MFA fatigue indicator
Error Code 50133
Session revoked or SSO artifact invalid
HIGH - Session hijacking indicator
Error Code 50076
MFA required but not provided
MEDIUM - Possible MFA bypass attempt
Error Code 0
Successful authentication
Normal successful login (validate carefully only when paired with suspicious failures)
Error Code 50053
Account locked or malicious IP
HIGH - Brute force attempts
Error Code 50074
MFA challenge not passed
HIGH - User failed MFA
Error Code 500121
MFA prompt timeout
MEDIUM - Possible MFA fatigue indicator
Error Code 50133
Session revoked or SSO artifact invalid
HIGH - Session hijacking indicator
Error Code 50076
MFA required but not provided
MEDIUM - Possible MFA bypass attempt
* Compare distances and times of consecutive sign-ins for the same user.
* Flag events where travel speed exceeds physical limits as potential unauthorized access.
Example: Same user signing in from Chennai to Mumbai (India) in 30 minutes triggers an alert.
Distance - 5,560 km.
Required speed - 11,000 km/h
The event is flagged as impossible travel.
* Flag events where travel speed exceeds physical limits as potential unauthorized access.
Example: Same user signing in from Chennai to Mumbai (India) in 30 minutes triggers an alert.
Distance - 5,560 km.
Required speed - 11,000 km/h
The event is flagged as impossible travel.
This query analyzes login events to identify users with more than five failed login attempts. It filters for login-related events, groups the data by username, endpoint name, failure reason, login type, and associated indicators, then counts the number of failed attempts. The results are sorted in descending order of failed attempts to highlight potentially suspicious activity.
This event is generated when an authenticated user who is not allowed to log on remotely attempts to connect to this computer through Remote Desktop.
Often, this event can be generated by attackers when searching for available windows servers in the network.
Often, this event can be generated by attackers when searching for available windows servers in the network.
Detect Attempt PrintNightmare (CVE-2021-1675) Remote code execution in Windows Spooler Service
This rule detects failed user login attempts within Bitbucket. It specifically looks for audit events categorized as 'Authentication' with the action 'User login failed'. This type of event can indicate various activities, including legitimate users mistyping passwords, or malicious actors attempting to brute-force credentials or perform credential stuffing attacks against Bitbucket accounts.
This rule detects when Okta FastPass successfully identifies and prevents an authentication attempt originating from a known phishing site. It specifically looks for Okta System Log events where the outcome reason is 'FastPass declined phishing attempt', the outcome result is 'FAILURE', and the event type is 'user.authentication.auth_via_mfa'. This indicates that a user attempted to authenticate via MFA, but Okta FastPass intervened due to a detected phishing attempt.
This rule detects unauthorized access attempts to resources within Bitbucket. It specifically looks for audit events categorized under 'Security' with the action 'Unauthorized access to a resource'. This indicates that a user or system tried to access a Bitbucket resource without proper permissions.
Detects SSH user login access failures in Bitbucket. This rule can be noisy and is recommended to be used with correlation based on the "author.name" field to reduce false positives.
Detects when a user attempts to access an application in Okta without proper authorization. This could indicate an attacker trying to gain unauthorized access to resources or a legitimate user attempting to access an application they do not have permissions for.
Detects when a user has potentially entered their password into the username field during a failed Okta login attempt. This can lead to the password being retained in log files, posing a security risk.
This rule detects a highly suspicious sequence of events: a user clicking on a URL (potentially a phishing link) followed by a risky sign-in attempt to Azure AD from an IP address outside the organization's defined range. The rule specifically looks for sign-ins with a high-risk level (>= 50) that occur after a URL click event, suggesting a potential compromise initiated by a phishing attack.
This rule detects potential Pass the Hash (PtH) activity by monitoring Windows Security Event IDs 4624 (successful logon) and 4625 (failed logon) where the LogonType is 3 (Network) and the LogonProcessName is 'NtLmSsp'. It specifically filters out 'ANONYMOUS LOGON' to reduce false positives. This combination of events indicates an attempt to authenticate over the network using NTLM, which is characteristic of PtH attacks for lateral movement.
This rule detects instances where a user denies a multi-factor authentication (MFA) prompt. This could indicate that an attacker has successfully obtained the user's password and is attempting to gain unauthorized access, prompting the legitimate user for MFA approval. The user's denial signals that they did not initiate the login attempt.
Detects a failed logon attempt from a public IP address on a Windows system. This can indicate an attempt to gain unauthorized access, potentially through brute-force attacks or credential stuffing, especially if the system is not intended to be exposed to the internet for direct login.
Detects when failed sign-in attempts increase by 10% or greater within Azure AD. This could indicate brute-force attacks, password spraying, or attempts to gain unauthorized access to accounts.
This rule detects failed attempts by a user or process to call the 'LsaRegisterLogonProcess' function. This function requires the 'SeTcbPrivilege' privilege, which is typically held by legitimate logon processes. A failure to call this function, especially when combined with the '0x8010000000000000' keyword indicating a failure, could suggest an attacker (e.g., using tools like Rubeus) is attempting to interact with the Local Security Authority (LSA) to gain unauthorized access to credentials or perform other malicious activities. The rule specifically looks for Event ID 4673 (A privileged service was called) where the service is 'LsaRegisterLogonProcess()' and the operation failed.
Detects when an account that has been disabled or blocked attempts to sign in. This could indicate an attacker attempting to use compromised credentials for an account that is no longer active or has been locked out due to suspicious activity.
Page 25 of 38