Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
32 detections
Filters
Last updated
All Time
Detection languages
11
7
5
4
2
Contributors
6
6
4
3
2
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
13
9
8
2
1
Products / Services
9
7
6
5
4
MITRE Techniques
16
14
13
12
10
CVEs
1
IDS Classtypes
2
IDS Protocols
2
'Identifies accounts that have been locked out by smart lockout policies. Review this results for patterns that might suggest that a password spray is triggering these smart lockout events.
Ref : https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-user-accounts#monitoring-for-failed-unusual-sign-ins'
Ref : https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-user-accounts#monitoring-for-failed-unusual-sign-ins'
This query lists Active Directory accounts lockout and unlock events
'Identifies privileged accounts that have been locked out. Verify these lockout are due to legitimate user activity and not due to threat actors attempting to access the accounts.
Ref : https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-accounts#things-to-monitor'
Ref : https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-accounts#things-to-monitor'
'An account could be blocked/locked out due to multiple reasons. This hunting query summarize blocked/lockout accounts and checks if most recent signin events for them is after last blocked accounts
Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-user-accounts#monitoring-for-successful-unusual-sign-ins'
Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-user-accounts#monitoring-for-successful-unusual-sign-ins'
The following analytic detects multiple Okta accounts being locked out within a short period. It uses the user.account.lock event from Okta logs, aggregated over a 5-minute window, to identify this behavior. This activity is significant as it may indicate a brute force or password spraying attack, where an adversary attempts to guess passwords, leading to account lockouts. If confirmed malicious, this could result in potential account takeovers or unauthorized access to sensitive Okta accounts, posing a significant security risk.
This analytic identifies user accounts experiencing an excessive number of lockouts within a short timeframe. It leverages the 'Change' data model, specifically focusing on events where the result indicates a lockout. This activity is significant as it may indicate a brute-force attack or misconfiguration, both of which require immediate attention. If confirmed malicious, this behavior could lead to account compromise, unauthorized access, and potential lateral movement within the network.
This analytic detects endpoints that generate a high number of account lockouts within a short timeframe. It analyzes Windows security event logs, specifically the `Change` datamodel's `Account_Management` node, to count lockout events. This activity can indicate a brute-force attack or a misconfigured system causing repeated authentication failures. If malicious, it could lead to denial of service through account lockouts or signal an ongoing attempt to compromise user credentials.
Detects when a user's account in Okta is locked out or has reached the lockout limit, indicating potential brute-force attempts or suspicious login activity. The rule specifically looks for 'user.account.lock.limit' or 'user.account.lock' events where the security result action is 'BLOCK'.
Detects when a user's account is locked out or a user account has reached the lockout limit.
Identifies user accounts that have been locked due to multiple failed sign-in attempts with incorrect credentials. This often indicates a brute-force attack or password guessing attempt against user accounts.
Account Lockout
Sigma
Identifies user account which has been locked because the user tried to sign in too many times with an incorrect user ID or password.
Page 2 of 2