Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,443
11,831
5,875
5,151
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
This rule detects suspected password spraying attacks identified by Okta's ThreatInsight. It specifically looks for Okta security events categorized as 'Password Spray' and can additionally increase the risk score if the originating IP address is marked as suspicious by Okta ThreatInsight or if the login attempt originates from certain unauthorized geographies (Cuba, Iran, North Korea, Russia, Syria).
This rule detects when the AWS IAM AdministratorAccess policy is attached to a user, group, or role. This action grants full administrative privileges and can be used by an attacker for privilege escalation, persistence, or to establish initial access within an AWS environment. The rule specifically looks for CloudTrail events indicating policy attachment actions (AttachUserPolicy, AttachGroupPolicy, AttachRolePolicy) where the target resource is the predefined 'AdministratorAccess' policy and the action was allowed.
This rule detects when a user in OneLogin reveals another user's application password. This is identified by monitoring 'USER_RESOURCE_ACCESS' events from 'ONELOGIN_SSO' where the product event type is '240' (indicating an actor user revealed a password to an app for another user) and the principal user ID is different from the target user ID. This scenario suggests unauthorized access or disclosure of credentials.
This rule detects a successful OneLogin login event that is preceded by multiple failed One-Time Password (OTP) attempts within a 15-minute window for the same user. Specifically, it looks for at least four failed OTP challenges followed by a successful OTP verification and then a successful user login. This pattern is indicative of an OTP brute-force attack where an attacker is attempting to guess the correct OTP.
This rule detects targeted brute-force attacks against an Okta organization. It specifically looks for events from Okta ThreatInsight where known malicious IPs are attempting to access a specific user account, indicated by multiple failed authentication attempts for the same user within a one-hour window. The rule leverages Okta's security.attack.start event type to identify these activities.
This rule detects when a single user account (principal) assumes the identity of multiple other user accounts (targets) within the OneLogin SSO system. Specifically, it triggers if a user, identified by their `userid`, performs "USER_RESOURCE_ACCESS" events as more than 3 distinct target users within a one-hour window. This behavior can indicate an attacker attempting to gain access to multiple accounts after compromising a single set of credentials, or an insider abusing their privileges.
This rule detects suspicious user login activity where a single user attempts to log in from multiple distinct countries within a 24-hour period. This behavior can indicate a compromised account being used by an attacker from a different geographic location than the legitimate user, or a user attempting to bypass security controls. The rule also assigns a higher risk score if the login originates from specific high-risk countries (Cuba, Iran, North Korea, Russia, Syria).
Detects usage of service account key from multiple countries using Chronicle GeoIP enrichment.
Detects when a service account key is created in or uploaded to a monitored Google Cloud project.
Okta ThreatInsight detects access requests from known malicious IPs targeting a specific org.
Detects when AWS API Gateway keys are accessed.
Detects the execution of Dumpert, a tool used to dump the memory of the lsass.exe process, which often contains sensitive credential material. Detection is based on specific MD5 hash values or the presence of 'Dumpert.dll' in the command line.
Detects a successful attempt to retrieve the encrypted Administrator password for a Windows EC2 instance.
Detects when a high number of failed authentication attempts happen for unknown users.
Detects unusual number of failed authentications from the same IP for valid users.
Okta Mismatch Between Source and Response for Verify Push Request
Okta ThreatInsight detects multiple login failures from the same IP across one or more Okta orgs.
Okta's ThreatInsight can identify Password Spray attacks.
Detects when a user revealed another user's application password.
Detects wceaux.dll access while WCE pass-the-hash remote command execution on source host
Detect when a user creates a new access key for another user and escalates privileges using this newly created access key from the same IP.
Page 195 of 206