Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
782 detections
Filters
Last updated
All Time
Detection languages
431
116
112
63
22
Contributors
176
85
81
80
70
Categories
20,443
11,831
5,875
5,151
4,864
782
Platforms
340
223
141
138
71
Products / Services
319
167
85
57
50
MITRE Techniques
413
348
255
231
200
CVEs
5
5
3
2
2
IDS Classtypes
7
2
1
1
1
IDS Protocols
8
2
1
1
Detects potential password spraying activity in Azure Active Directory by identifying a single source IP address that authenticates against multiple distinct user accounts within a short time frame. The rule flags instances where there are numerous authentication attempts across many users, characterized by a low per-user failure count followed by at least one successful authentication, which is indicative of a successful password spray attempt.
Detects a suspicious pattern where a user account experiences a burst of multiple MFA failures followed by an anomalous successful authentication within a short 15-minute window. This behavior is indicative of automated MFA fatigue attacks or attempts to exploit MFA bypass vulnerabilities.
Detects multiple consecutive MFA challenge events (ResultCode 50074 or 50140) for a single user session occurring on unmanaged devices (trustType is null or unknown) while using the Chrome browser. This pattern may indicate an attempt to bypass or exhaust MFA mechanisms, or credential abuse on non-compliant devices.
Detects potential Adversary-in-the-Middle (AiTM) phishing activity by monitoring specific Azure AD sign-in failure codes (50074: strong authentication is required, 50140: interruption of sign-in) in conjunction with logins from unmanaged devices.
Detects instances where a user account experiences multiple failed sign-in attempts followed by a successful sign-in from a different, geographically distant location within a short timeframe, indicating impossible travel and potential credential compromise.
Detects anomalous SSH authentication patterns characterized by a high volume of failed logon attempts (>= 10) originating from a specific IP address within a short timeframe (30 minutes), followed by a successful authentication to the same target device. This pattern is indicative of a successful credential brute-force or password guessing attack against an exposed SSH service.
Detects authentication failures in Microsoft Entra ID associated with external MFA providers. This condition, specifically indicated by failure codes 70002 or 50012 and associated error messages regarding signature validation or external token trust, may indicate an attempt to bypass authentication via a rogue MFA provider or a misconfigured integration.
Detects high-frequency authentication failures in Entra ID (Azure AD) originating from External Authentication Method (EAM) providers. The rule identifies instances where the external identity token fails signature or key-ID validation (AADSTS50012/AADSTS70002), which may indicate configuration issues with the external IdP or attempts to forge authentication tokens.
Detects high-frequency authentication failures in Entra ID (Azure AD) originating from External Authentication Method (EAM) providers. The rule identifies instances where the external identity token fails signature or key-ID validation (AADSTS50012/AADSTS70002), which may indicate configuration issues with the external IdP or attempts to forge authentication tokens.
Detects OfficeHome sign-in events featuring the 90014 error code (missing OAuth nonce). The rule looks for a specific mismatch where mobile browser User Agents are observed on a system reported as Windows 10, a pattern consistent with Adversary-in-the-Middle (AiTM) session token replay attacks attempting to access Microsoft 365 environments.
Detects anomalous, high-volume authentication failures originating from a single source IP address targeting multiple distinct internal devices within a short timeframe. This behavior is indicative of a password spraying or brute-force attack.
Detects sign-in failures in Azure Active Directory specifically linked to MFA error codes 50074 (MFA required) or 50140 (MFA interruption/continuation). This logic monitors for users who are unable to complete the MFA challenge during the OfficeHome sign-in process, which may indicate issues with MFA registration, configuration, or an attempt to bypass MFA requirements.
This rule detects a suspicious Azure sign-in sequence, identified by error code 50074 (User failed MFA) followed by 50140 (This error occurred due to 'Keep me signed in' interrupt when the user was authenticating). This pattern is indicative of an Adversary-in-the-Middle (AiTM) phishing attack where the attacker is attempting to bypass MFA or manipulate session persistence after capturing initial credentials.
Detects instances where a user account experiences multiple failed sign-in attempts followed by a successful sign-in from a different, geographically distant location within a short timeframe, indicating impossible travel and potential credential compromise.
Detects potential Adversary-in-the-Middle (AitM) activity where a user triggers both a standard MFA requirement (50074) and a subsequent MFA requirement within the same session (50140), potentially indicating the user is interacting with a proxy site that requires re-authentication or session interception. The rule specifically looks for users who trigger these events in short succession, often associated with phishing campaigns aiming to bypass MFA.
Detects anomalous sign-in activity where a user triggers both Error Code 50074 (MFA required) and 50140 (MFA bypass occurred or not required/invalidated) in a short window of time (less than 1 hour). The rule looks for sessions on unmanaged devices (empty TrustType) using Chrome, which may indicate an adversary attempting to bypass or manipulate MFA enrollment or verification flows.
Detects the creation of a new user account in Nacos, followed immediately by an authentication failure and then a successful authentication, which may indicate an attacker using automated tools to create and test a backdoored administrative account.
Detects anomalous SSH authentication patterns characterized by a high volume of failed logon attempts (>= 10) originating from a specific IP address within a short timeframe (30 minutes), followed by a successful authentication to the same target device. This pattern is indicative of a successful credential brute-force or password guessing attack against an exposed SSH service.
This rule detects a sequence of authentication activity on VPN gateways (Palo Alto, Fortinet, Cisco) where a source IP experiences multiple failed login attempts followed by at least one successful login within a 60-minute window, potentially indicating a successful brute force or password spraying attack.
Detects a pattern of multiple failed authentication attempts (brute force) from an external IP address followed by a successful authentication event on remote access services such as RDP, VPN, or NTLM. The rule filters for non-private IP addresses and flags successes occurring outside of standard business hours.
This rule detects a sequence of authentication activity on VPN gateways (Palo Alto, Fortinet, Cisco) where a source IP experiences multiple failed login attempts followed by at least one successful login within a 60-minute window, potentially indicating a successful brute force or password spraying attack.
Page 7 of 38