Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
782 detections
Filters
Last updated
All Time
Detection languages
431
116
112
63
22
Contributors
176
85
81
80
70
Categories
20,443
11,831
5,875
5,151
4,864
782
Platforms
340
223
141
138
71
Products / Services
319
167
85
57
50
MITRE Techniques
413
348
255
231
200
CVEs
5
5
3
2
2
IDS Classtypes
7
2
1
1
1
IDS Protocols
8
2
1
1
This rule detects failed attempts to elevate privileges (PIM activation) in Azure Active Directory from devices that are not designated as Privileged Access Workstations (PAW) or Secure Access Workstations (SAW). It specifically looks for messages indicating 'Add member to role completed (PIM activation)' in the sign-in logs, combined with conditions that identify non-compliant devices, unapproved IP addresses, unapproved countries, or unapproved device information. The rule is designed to flag suspicious privilege elevation attempts that originate from unauthorized or untrusted environments, which could indicate a compromised account or an attempt to bypass security controls.
Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge.
Detects failed AWS console login attempts due to authentication failures. Monitoring these events is crucial for identifying potential brute-force attacks or unauthorized access attempts to AWS accounts.
Detects suspicious administrative activities on F5 BIG-IP devices, such as failed logins or configuration changes. This is based on recommendations from F5 in response to a security incident disclosed in October 2025 where a threat actor gained access to BIG-IP development environments. F5 advised customers to enhance monitoring for admin logins, failed authentications, and privilege and configuration changes.
Detects failed attempts to sign in to disabled accounts within Azure Active Directory. This could indicate an attacker attempting to use compromised credentials for an account that has been deactivated, or an attempt to bypass security controls by targeting dormant accounts.
This rule detects unusual authentication interruptions in Azure Active Directory sign-in logs. Specifically, it looks for three types of ResultType and ResultDescription combinations: '50097 - Device authentication is required', '50155 - DeviceAuthenticationFailed', and '50158 - ExternalSecurityChallenge - External security challenge was not satisfied'. These events indicate that an authentication attempt was interrupted or failed due to device-related issues or an unmet external security challenge, which could be indicative of an adversary attempting to bypass authentication mechanisms or encountering unexpected security controls.
This rule detects sign-in failures in Azure Active Directory (now Microsoft Entra ID) that are specifically due to Conditional Access policies not being met. It identifies attempts where a user or service tried to authenticate but was blocked because the Conditional Access requirements were not satisfied. This could indicate an attacker attempting to bypass security controls, or legitimate users/services failing to meet policy requirements.
Detects failed sign-in attempts for privileged roles where the user does not meet expected security controls, such as signing in from an unapproved country, IP address, or device. This rule helps identify potential unauthorized access attempts to administrative accounts.
Detects when user access has been blocked by Azure Conditional Access policies. This indicates that token issuance was denied, which could be a sign of unauthorized login attempts to valid accounts.
Detects when a user without the necessary permissions attempts to invite a guest user in an Azure environment, indicated by a failed 'Invite external user' operation in the audit logs. This could signify an attempt at unauthorized access, privilege escalation, or persistence.
Detects failed authentication attempts originating from geographic locations (countries) that are not part of the organization's approved operational regions. This rule helps identify potential unauthorized access attempts or credential stuffing attacks from unexpected sources.
Triggers when more than 5 failed login detected in one hour time span. set rule to run every 60mins
This detection identifies signs of SSH brute-force attacks by monitoring for a high number of failed login attempts within a short time frame. Such activity may indicate an attacker attempting to gain unauthorized access through password guessing.
Detects SSH user login access failures.
Please note that this rule can be noisy and is recommended to use with correlation based on "author.name" field.
Please note that this rule can be noisy and is recommended to use with correlation based on "author.name" field.
This rule detects suspicious failed logon attempts by monitoring specific uncommon error codes. These error codes indicate issues such as logons to disabled accounts, attempts outside authorized hours, from unauthorized workstations, or due to trust relationship failures or insufficient logon rights. Such failures can suggest an adversary attempting to bypass security controls or test account validity and permissions.
Researching about how to classify ISP based on different factors, I created a query based on ISP sign-in attempts.
Detects M365 Copilot users with failed authentication attempts, MFA failures, or multi-location access patterns indicating potential credential attacks or account compromise. The detection aggregates M365 Copilot Graph API authentication events per user, calculating metrics like distinct cities/countries accessed, unique IP addresses and browsers, failed login attempts (status containing "fail" or "error"), and MFA failures (error code 50074). Users are flagged when they access Copilot from multiple cities (cities_count > 1), experience any authentication failures (failed_attempts > 0), or encounter MFA errors (mfa_failures > 0), which are indicators of credential stuffing, brute force attacks, or compromised accounts attempting to bypass multi-factor authentication.
The following analytic identifies instances where users may have mistakenly entered their passwords in the username field during authentication attempts. It detects this by analyzing failed authentication events with usernames longer than 7 characters and high Shannon entropy, followed by a successful authentication from the same source to the same destination. This activity is significant as it can indicate potential security risks, such as password exposure. If confirmed malicious, attackers could exploit this to gain unauthorized access, leading to potential data breaches or further compromise of the system.
This rule detects successful or failed logon attempts originating from IP addresses identified by threat intelligence as associated with botnets, command and control (C2) infrastructure, or proxies. The rule specifically looks for 'LogOn' or 'FailedLogOn' activity types where the source IP's threat intelligence indicator type is 'Botnet', 'C2', or 'Proxy', and where activity insights are available.
This rule detects multiple failed SSL login attempts from a single source IP to a destination IP within a 24-hour period. A threshold of 10 failed attempts is used to identify potential brute-force attacks or credential stuffing against SSL-enabled services.
Detects failed AWS console login attempts due to authentication failures. Monitoring these events is crucial for identifying potential brute-force attacks or unauthorized access attempts to AWS accounts.
Page 26 of 38