Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
782 detections
Filters
Last updated
All Time
Detection languages
431
116
112
63
22
Contributors
176
85
81
80
70
Categories
20,443
11,831
5,875
5,151
4,864
782
Platforms
340
223
141
138
71
Products / Services
319
167
85
57
50
MITRE Techniques
413
348
255
231
200
CVEs
5
5
3
2
2
IDS Classtypes
7
2
1
1
1
IDS Protocols
8
2
1
1
This rule detects a password-spraying attack pattern directed at privileged or manager-titled accounts. It monitors for multiple failed sign-in attempts from a single source IP address against a large volume of distinct user accounts identified as managers or senior staff. The detection logic filters for low-frequency attempts per account, which is indicative of a distributed spray attack designed to evade account lockout thresholds while focusing on high-value targets.
Detects a suspected account takeover pattern where an Azure AD account logs into the Azure Portal shortly after experiencing failed authentication attempts from the same IP address. The detection correlates password spraying or VPN probing activity (multiple failed logins against different users from a single IP) with subsequent successful or near-successful logins (MFA enrollment interrupts) on the Azure Portal, signaling potential post-compromise activity.
Detects a suspected account takeover pattern where an Azure AD account logs into the Azure Portal shortly after experiencing failed authentication attempts from the same IP address. The detection correlates password spraying or VPN probing activity (multiple failed logins against different users from a single IP) with subsequent successful or near-successful logins (MFA enrollment interrupts) on the Azure Portal, signaling potential post-compromise activity.
Detects a suspected account takeover pattern where an Azure AD account logs into the Azure Portal shortly after experiencing failed authentication attempts from the same IP address. The detection correlates password spraying or VPN probing activity (multiple failed logins against different users from a single IP) with subsequent successful or near-successful logins (MFA enrollment interrupts) on the Azure Portal, signaling potential post-compromise activity.
Detects a suspected account takeover pattern where an Azure AD account logs into the Azure Portal shortly after experiencing failed authentication attempts from the same IP address. The detection correlates password spraying or VPN probing activity (multiple failed logins against different users from a single IP) with subsequent successful or near-successful logins (MFA enrollment interrupts) on the Azure Portal, signaling potential post-compromise activity.
Detects the TeamFiltration/UNK_CondorFiltration spray signature: a large
number of distinct target UserPrincipalNames within a single tenant, each
receiving only a handful of sign-in attempts, spread across many distinct
AWS EC2-hosted source IPs/regions within a short time window. Individual
sign-ins from AWS-hosted IP ranges (VPN gateways, corporate cloud proxies,
remote contractors) are not flagged on their own; the rule requires both
the account-fanout and the IP-rotation dimensions to co-occur for the same
tenant in the same window.
number of distinct target UserPrincipalNames within a single tenant, each
receiving only a handful of sign-in attempts, spread across many distinct
AWS EC2-hosted source IPs/regions within a short time window. Individual
sign-ins from AWS-hosted IP ranges (VPN gateways, corporate cloud proxies,
remote contractors) are not flagged on their own; the rule requires both
the account-fanout and the IP-rotation dimensions to co-occur for the same
tenant in the same window.
Detects a distributed password spraying campaign targeting cloud accounts, characterized by a large number of distinct accounts being targeted simultaneously from multiple AWS-hosted IP addresses, with a low volume of attempts per account per hour to evade standard threshold-based detection.
Detects a distributed password spraying campaign targeting cloud accounts, characterized by a large number of distinct accounts being targeted simultaneously from multiple AWS-hosted IP addresses, with a low volume of attempts per account per hour to evade standard threshold-based detection.
Detects a distributed password spraying campaign targeting cloud accounts, characterized by a large number of distinct accounts being targeted simultaneously from multiple AWS-hosted IP addresses, with a low volume of attempts per account per hour to evade standard threshold-based detection.
Detects a distributed password spraying campaign targeting cloud accounts, characterized by a large number of distinct accounts being targeted simultaneously from multiple AWS-hosted IP addresses, with a low volume of attempts per account per hour to evade standard threshold-based detection.
Detects a suspicious authentication pattern involving 3 or more MFA failures within 15 minutes, immediately followed by an MFA success for the same user. This pattern is characteristic of potential Adversary-in-the-Middle (AiTM) activity, where an attacker intercepts a session or MFA token and relays it through separate infrastructure, while the legitimate user's own MFA attempts fail or time out.
This rule monitors for potential Kerberos Golden Ticket attacks by detecting specific indicators within Windows security events. It identifies Event ID 4769 with a PAC validation failure status (0x1F), and the use of weak RC4 encryption (0x17) in either TGT requests (Event ID 4768) or service ticket requests (Event ID 4769). These behaviors are often associated with forged Kerberos tickets where the attacker may be using weak encryption or malformed PAC data.
Detects high-volume authentication failures originating from a single source IP targeting multiple unique user accounts, indicative of password spraying or credential stuffing attacks against cloud identity providers.
Detects coordinated credential stuffing campaigns originating from shared IP infrastructure. The rule identifies patterns where multiple distinct accounts are targeted with failed sign-in attempts, characterized by rapidly rotating user-agent/device fingerprints while remaining under standard per-account and per-IP throttling limits. It focuses on the combination of high unique account counts, rotating user-agents, and sustained activity over a specific time window.
Detects credential-stuffing campaigns that employ AI/ML-tuned inter-request timing jitter to bypass traditional rate-limiting and fixed-interval bot detection, specifically flagging interactive or network logon failures on Windows hosts.
This rule detects anomalous authentication behavior on SonicWall VPN appliances characterized by either multiple distinct source IP addresses for a single user or a high volume of failed authentication attempts followed by a successful login. These patterns are often indicative of credential stuffing or password spraying campaigns, such as those observed in Akira ransomware affiliate initial access activities.
Detects repeated MFA authentication failures for specific Microsoft applications (like OfficeHome, My Apps, My Sign-Ins) from the same user and source IP, typically indicative of an MFA fatigue (prompt bombing) attack. The rule identifies multiple authentication failures or interruptions (ErrorCode 50074 or 50140) from unmanaged or unregistered devices, which suggests an adversary attempting to force a user to approve an MFA request.
Detects OfficeHome sign-in events featuring the 90014 error code (missing OAuth nonce). The rule looks for a specific mismatch where mobile browser User Agents are observed on a system reported as Windows 10, a pattern consistent with Adversary-in-the-Middle (AiTM) session token replay attacks attempting to access Microsoft 365 environments.
Detects anomalous sign-in attempts to the OfficeHome application where an OAuth 90014 error (nonce mismatch/invalid) is returned. The detection specifically monitors for requests originating from mobile browsers on Windows 10 user agents, which is indicative of potential adversary-in-the-middle (AiTM) phishing activity attempting to bypass or intercept authentication tokens.
Detects MFA fatigue or push-bombing attacks where a user account experiences an abnormally high volume of MFA request denials in a short duration (10 minutes), followed by a successful authentication event. The rule specifically looks for evidence where the successful authentication potentially originates from a different IP address than the failed attempts.
This rule detects a sequence of events where a database user record is updated (inserting a new password hash) followed by a successful authentication for that same user, immediately following a recent login failure. This pattern is indicative of an attacker modifying credentials and then testing the new access.
Page 6 of 38