Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
608 detections
Filters
Last updated
All Time
Detection languages
346
84
61
42
40
Contributors
155
87
50
48
42
Categories
348
215
150
124
82
Platforms
197
190
120
88
75
Products / Services
169
92
45
44
43
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
10
5
1
1
1
IDS Classtypes
35
4
4
3
IDS Protocols
35
6
1
1
SSH Brute Force Attempt Detected
Suricata
Detects repeated failed SSH authentication attempts which may indicate brute force activity against SSH services. The rule specifically looks for 8 SSH connection attempts to port 22 within a 60-second window from the same source IP.
This rule detects potential GitHub token theft or abuse activity by identifying GitHub tokens that are used from an unusually high number of distinct IP addresses or for an unusually high number of uses within a one-hour window. Specifically, it looks for tokens with more than 5 uses and more than 2 distinct IP addresses in an hour. This behavior could indicate that a compromised token is being used by an attacker from multiple locations or in an automated fashion.
This rule detects suspicious multi-factor authentication (MFA) behavior by identifying MFA denials that occur from an unknown IP address or with an unusual authentication method for a given user. It establishes a baseline of known IP addresses and usual authentication methods for each user over a 30-day period. Alerts are generated for recent MFA denials (within the last hour) if they involve a high-risk denial detail (e.g., too many invalid codes, user blocked) combined with an unknown IP or unusual authentication method, or if they involve any other denial reason combined with both an unknown IP and an unusual authentication method. This helps to identify potential MFA fatigue attacks or attempts to bypass MFA.
This rule detects a successful Remote Desktop Protocol (RDP) login that is immediately preceded by 20 or more failed RDP authentication attempts from the same source IP to the same destination IP within a 15-minute window. This pattern is indicative of a brute force attack that has successfully compromised credentials.
This rule detects a high volume (50 or more) of failed authenticated SMTP login attempts to Office 365 Exchange Online from a single IP address within a 24-hour period. The failures are specifically for error codes 50126 (invalid username or password) or 50053 (account locked). This pattern is indicative of a brute-force or password-guessing attack against Exchange Online accounts.
This Query will generate logon events (Login Successful or failed) which are coming from Public IP and hits are greater than 3 (you can modify count Limit).
Detects the generation of pre-authentication session cookies via intentionally failed login attempts to the `login_only` endpoint. This detects the initial staging phase of the CVE-2026-41940 exploit chain.
This rule detects an IP address attempting to log in unsuccessfully to more than 20 distinct user accounts. This behavior is indicative of a brute-force attack or password spraying attempt against multiple accounts from a single source.
This rule detects an IP address attempting to log in unsuccessfully to more than 20 distinct user accounts. This behavior is indicative of a brute-force attack or password spraying attempt against multiple accounts from a single source.
Detects inbound network connections and Azure AD sign-in attempts originating from the 21-IP RDP scanning fleet attributed to AS213438 (ColocaTel Inc., Seychelles), as reported by GreyNoise on April 10, 2026. The fleet generated 67.4% of global RDP Crawler activity on April 7, 2026 across four /24 blocks geolocated to the Netherlands. The same ASN demonstrated a burst-and-crash pattern in both March and April 2026, suggesting further rotations are likely.
Detects successful authentication from potential clients using legacy authentication via user agent strings. This could be a sign of MFA bypass using a password spray attack.
Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge.
Detect access has been blocked by Conditional Access policies.
The access policy does not allow token issuance which might be sights≈ of unauthorizeed login to valid accounts.
The access policy does not allow token issuance which might be sights≈ of unauthorizeed login to valid accounts.
Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.
Detects user authentication failure events.
Please note that this rule can be noisy and it is recommended to use with correlation based on "author.name" field.
Please note that this rule can be noisy and it is recommended to use with correlation based on "author.name" field.
Alert on when legacy authentication has been used on an account
User has indicated they haven't instigated the MFA prompt and could indicate an attacker has the password for the account.
Detects BGP failures which may be indicative of brute force attacks to manipulate routing
Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels
Detects BGP failures which may be indicative of brute force attacks to manipulate routing.
Detects juniper BGP missing MD5 digest. Which may be indicative of brute force attacks to manipulate routing.
Page 19 of 29