Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
782 detections
Filters
Last updated
All Time
Detection languages
431
116
112
63
22
Contributors
176
85
81
80
70
Categories
20,443
11,831
5,875
5,151
4,864
782
Platforms
340
223
141
138
71
Products / Services
319
167
85
57
50
MITRE Techniques
413
348
255
231
200
CVEs
5
5
3
2
2
IDS Classtypes
7
2
1
1
1
IDS Protocols
8
2
1
1
Detects instances where a user account experiences multiple failed sign-in attempts followed by a successful sign-in from a different, geographically distant location within a short timeframe, indicating impossible travel and potential credential compromise.
This rule detects high-frequency account and email address enumeration attempts. It monitors syslog data for SMTP commands such as VRFY, EXPN, or RCPT TO, and analyzes Microsoft Entra ID (SigninLogs) for authentication failures specifically associated with error code 50034 (user not found). Both behaviors are indicative of an adversary attempting to validate user identities within an environment, often as a precursor to targeted phishing or brute-force attacks.
This rule detects a suspicious Azure sign-in sequence, identified by error code 50074 (User failed MFA) followed by 50140 (This error occurred due to 'Keep me signed in' interrupt when the user was authenticating). This pattern is indicative of an Adversary-in-the-Middle (AiTM) phishing attack where the attacker is attempting to bypass MFA or manipulate session persistence after capturing initial credentials.
Detects multiple authentication failures in Azure AD (specifically error codes 50074: strong authentication required/MFA failure and 50140: interruption of MFA completion) originating from devices identified as either unmanaged or non-compliant. This pattern often indicates an adversary attempting to brute force or bypass conditional access policies by leveraging credentials where the device security posture is insufficient.
This rule identifies potentially malicious Azure AD/Entra authentication flows by flagging interruptions during MFA (e.g., failure codes 50074, 50140 indicating MFA requirements or time-outs during suspected AiTM phishing attempts) and the usage of Device Code Grant flows, which are frequently abused by adversaries to bypass MFA and capture session tokens.
Detects multiple failed multifactor authentication (MFA) attempts from the same user on an unmanaged device. This behavior is indicative of an adversary attempting to bypass MFA or perform MFA fatigue attacks using stolen credentials.
Detects a suspicious sign-in sequence indicative of an Adversary-in-the-Middle (AiTM) phishing attack. The rule identifies a user attempting to sign in from an unmanaged device (triggered by Azure AD error 50074, requiring secondary authentication) followed shortly by an interruption in session persistence (triggered by error 50140) while using a browser user agent, suggesting the session is being relayed through a malicious proxy.
Detects a sequence of authentication events indicative of Adversary-in-the-Middle (AiTM) phishing, where a user session experiences MFA-related errors (50074, 50140) followed by a successful sign-in (0). This pattern suggests an adversary proxying credentials and MFA requests in real-time.
Detects high-volume credential guessing attacks against applications, characterized by a large number of distinct source IP addresses and geographic locations. This pattern is indicative of attackers using residential proxy pools to distribute their attempts, effectively bypassing traditional rate limiting or per-IP WAF thresholds while targeting authentication or error oracles. The rule specifically filters for relevant failure codes and enforces constraints on IP/user diversity to reduce noise from single-point-of-failure events or legitimate infrastructure.
Detects high-volume credential guessing attacks against applications, characterized by a large number of distinct source IP addresses and geographic locations. This pattern is indicative of attackers using residential proxy pools to distribute their attempts, effectively bypassing traditional rate limiting or per-IP WAF thresholds while targeting authentication or error oracles. The rule specifically filters for relevant failure codes and enforces constraints on IP/user diversity to reduce noise from single-point-of-failure events or legitimate infrastructure.
Detects anomalous SSH authentication patterns characterized by a high volume of failed logon attempts (>= 10) originating from a specific IP address within a short timeframe (30 minutes), followed by a successful authentication to the same target device. This pattern is indicative of a successful credential brute-force or password guessing attack against an exposed SSH service.
Detects anomalous SSH authentication patterns characterized by a high volume of failed logon attempts (>= 10) originating from a specific IP address within a short timeframe (30 minutes), followed by a successful authentication to the same target device. This pattern is indicative of a successful credential brute-force or password guessing attack against an exposed SSH service.
Detects anomalous, high-volume authentication failures originating from a single source IP address targeting multiple distinct internal devices within a short timeframe. This behavior is indicative of a password spraying or brute-force attack.
Detects anomalous, high-volume authentication failures originating from a single source IP address targeting multiple distinct internal devices within a short timeframe. This behavior is indicative of a password spraying or brute-force attack.
Detects high-volume credential guessing attacks against applications, characterized by a large number of distinct source IP addresses and geographic locations. This pattern is indicative of attackers using residential proxy pools to distribute their attempts, effectively bypassing traditional rate limiting or per-IP WAF thresholds while targeting authentication or error oracles. The rule specifically filters for relevant failure codes and enforces constraints on IP/user diversity to reduce noise from single-point-of-failure events or legitimate infrastructure.
Detects high-volume credential guessing attacks against applications, characterized by a large number of distinct source IP addresses and geographic locations. This pattern is indicative of attackers using residential proxy pools to distribute their attempts, effectively bypassing traditional rate limiting or per-IP WAF thresholds while targeting authentication or error oracles. The rule specifically filters for relevant failure codes and enforces constraints on IP/user diversity to reduce noise from single-point-of-failure events or legitimate infrastructure.
Detects high-volume credential guessing attacks against applications, characterized by a large number of distinct source IP addresses and geographic locations. This pattern is indicative of attackers using residential proxy pools to distribute their attempts, effectively bypassing traditional rate limiting or per-IP WAF thresholds while targeting authentication or error oracles. The rule specifically filters for relevant failure codes and enforces constraints on IP/user diversity to reduce noise from single-point-of-failure events or legitimate infrastructure.
Detects specific authentication failure codes (50074, 50140) associated with MFA bypass and session persistence interruptions, which are characteristic of Adversary-in-the-Middle (AiTM) phishing attacks targeting modern authentication flows.
Detects a sequence of multiple VPN authentication failures from a single IP address followed by a successful authentication within a 10-minute window, which is indicative of a successful credential brute force attack.
Detects a sequence of multiple VPN authentication failures from a single IP address followed by a successful authentication within a 10-minute window, which is indicative of a successful credential brute force attack.
Detects unauthenticated execution of sensitive Grafana MCP tools (tools/call, grafana_api_request) by identifying session IDs that lack a corresponding authenticated handshake event. This behavior is indicative of potential session spoofing or abuse of the MCP protocol where an attacker attempts to interact with privileged tools without performing a valid authentication handshake.
Page 8 of 38