| sigma |
Sign-in Failure Due to Conditional Access Requirements Not Met |
test |
2026-10-17 |
| elastic |
Potential Successful SSH Brute Force Attack via macOS Security Events |
production |
2026-10-06 |
| elastic |
Potential SSH Brute Force Detected via macOS Security Events |
production |
2026-10-06 |
| elastic |
Multiple Logon Failure from the same Source Address |
production |
2026-10-06 |
| elastic |
Excessive Sudo Authentication Failures via macOS Security Events |
production |
2026-10-06 |
| elastic |
Privileged Accounts Brute Force |
production |
2026-10-06 |
| elastic |
OpenAI ChatGPT Enterprise Multiple Authentication Failures |
production |
2026-10-06 |
| elastic |
ESXi Multiple Logon Failures by User and Source |
production |
2026-09-30 |
| elastic |
Anthropic Multiple Authentication Failures |
production |
2026-09-25 |
| elastic |
M365 Identity User Account Lockouts |
production |
2026-09-18 |
| elastic |
M365 Identity User Brute Force Attempted |
production |
2026-09-18 |
| elastic |
Entra ID Protection - Risk Detection - User Risk |
production |
2026-09-18 |
| elastic |
Entra ID Protection - Risk Detection - Sign-in Risk |
production |
2026-09-18 |
| elastic |
Entra ID Sign-in TeamFiltration User-Agent Detected |
production |
2026-09-18 |
| elastic |
Entra ID MFA TOTP Brute Force Attempted |
production |
2026-09-18 |
| elastic |
Entra ID Sign-in Brute Force Attempted (Microsoft 365) |
production |
2026-09-18 |
| elastic |
Entra ID ROPC Authentication with Unknown Client ID |
production |
2026-09-18 |
| elastic |
Web Server Suspicious User Agent Requests |
production |
2026-09-18 |
| elastic |
AWS Management Console Brute Force of Root User Identity |
production |
2026-09-18 |
| elastic |
AWS Root Console Login Password Spraying |
production |
2026-09-18 |
| elastic |
AWS IAM Principal Enumeration via UpdateAssumeRolePolicy |
production |
2026-09-18 |
| elastic |
Entra ID User Sign-in Brute Force Attempted |
production |
2026-09-18 |
| elastic |
Entra ID Excessive Account Lockouts Detected |
production |
2026-09-18 |
| elastic |
Potential External Linux SSH Brute Force Detected |
production |
2026-09-18 |
| elastic |
Potential Linux Local Account Brute Force Detected |
production |
2026-09-18 |
| elastic |
Okta Successful Login After Credential Attack |
production |
2026-09-18 |
| elastic |
Potential Okta Password Spray (Single Source) |
production |
2026-09-18 |
| elastic |
Multiple Logon Failure Followed by Logon Success |
production |
2026-09-18 |
| elastic |
Multiple SonicWall Login Failures Followed by Successful Login |
production |
2026-09-18 |
| elastic |
Potential SIP REGISTER Brute Force |
production |
2026-09-18 |
| elastic |
Unusual Login Activity |
production |
2026-09-18 |
| elastic |
Spike in Successful Logon Events from a Source IP |
production |
2026-09-18 |
| elastic |
Spike in Logon Events |
production |
2026-09-18 |
| elastic |
Potential Okta Password Spray (Multi-Source) |
production |
2026-09-18 |
| elastic |
Spike in Failed Logon Events |
production |
2026-09-18 |
| elastic |
Potential macOS SSH Brute Force Detected |
production |
2026-09-18 |
| elastic |
Potential Malware-Driven SSH Brute Force Attempt |
production |
2026-09-18 |
| elastic |
Potential Successful SSH Brute Force Attack |
production |
2026-09-18 |
| elastic |
Potential Linux Hack Tool Launched |
production |
2026-09-18 |
| elastic |
Potential Password Spraying Attack via SSH |
production |
2026-09-18 |
| elastic |
Potential Internal Linux SSH Brute Force Detected |
production |
2026-09-18 |
| elastic |
Potential Okta Credential Stuffing (Single Source) |
production |
2026-09-18 |
| elastic |
Potential Okta Brute Force (Multi-Source) |
production |
2026-09-18 |
| elastic |
Potential Okta Brute Force (Device Token Rotation) |
production |
2026-09-18 |
| elastic |
Multiple Okta User Authentication Events with Same Device Token Hash |
production |
2026-09-18 |
| elastic |
Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy |
production |
2026-09-18 |
| elastic |
Attempts to Brute Force an Okta User Account |
production |
2026-09-18 |
| splunk |
Crowdstrike Medium Identity Risk Severity |
production |
2026-05-13 |
| splunk |
ESXi SSH Brute Force |
production |
2026-05-13 |
| splunk |
M365 Copilot Failed Authentication Patterns |
production |
2026-05-13 |
| splunk |
Okta MFA Exhaustion Hunt |
production |
2026-05-13 |
| splunk |
Okta Multiple Accounts Locked Out |
production |
2026-05-13 |
| splunk |
Okta Risk Threshold Exceeded |
production |
2026-05-13 |
| splunk |
PingID Multiple Failed MFA Requests For User |
production |
2026-05-13 |
| splunk |
ASL AWS Credential Access RDS Password reset |
production |
2026-05-13 |
| splunk |
ASL AWS IAM Assume Role Policy Brute Force |
production |
2026-05-13 |
| splunk |
AWS Credential Access RDS Password reset |
production |
2026-05-13 |
| splunk |
AWS IAM Assume Role Policy Brute Force |
production |
2026-05-13 |
| splunk |
O365 Excessive Authentication Failures Alert |
production |
2026-05-13 |
| splunk |
O365 Multiple OS Vendors Authenticating From User |
production |
2026-05-13 |
| splunk |
Crowdstrike Admin Weak Password Policy |
production |
2026-05-13 |
| splunk |
Crowdstrike Admin With Duplicate Password |
production |
2026-05-13 |
| splunk |
Crowdstrike High Identity Risk Severity |
production |
2026-05-13 |
| splunk |
Crowdstrike Medium Severity Alert |
production |
2026-05-13 |
| splunk |
Crowdstrike Multiple LOW Severity Alerts |
production |
2026-05-13 |
| splunk |
Crowdstrike Privilege Escalation For Non-Admin User |
production |
2026-05-13 |
| splunk |
Crowdstrike User Weak Password Policy |
production |
2026-05-13 |
| splunk |
Crowdstrike User with Duplicate Password |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Blocked Connection |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Repeated Blocked Connections |
production |
2026-05-13 |
| elastic |
Deprecated - Potential Successful Linux FTP Brute Force Attack Detected |
deprecated |
2026-02-04 |
| elastic |
Deprecated - Potential Successful Linux RDP Brute Force Attack Detected |
deprecated |
2026-02-04 |
| sigma |
AWS ConsoleLogin Failed Authentication |
experimental |
2025-10-19 |
| elastic |
Deprecated - Azure Entra Sign-in Brute Force Microsoft 365 Accounts by Repeat Source |
deprecated |
2025-07-16 |
| sigma |
MSSQL Server Failed Logon From External Network |
test |
2025-05-28 |
| elastic |
Deprecated - Potential Password Spraying of Microsoft 365 User Accounts |
deprecated |
2025-01-17 |
| sigma |
MSSQL Server Failed Logon |
test |
2024-06-26 |
| sigma |
External Remote SMB Logon from Public IP |
test |
2024-03-11 |
| sigma |
External Remote RDP Logon from Public IP |
test |
2024-03-11 |
| sigma |
Bitbucket User Login Failure |
test |
2024-02-25 |
| sigma |
Bitbucket User Login Failure Via SSH |
test |
2024-02-25 |
| sigma |
Password Spray Activity |
test |
2023-09-03 |
| elastic |
Potential SSH Brute Force Detected on Privileged Account |
deprecated |
2023-06-22 |
| sigma |
Potential MFA Bypass Using Legacy Client Authentication |
test |
2023-03-20 |
| sigma |
HackTool - CrackMapExec Execution |
test |
2023-03-08 |
| sigma |
HackTool - Hydra Password Bruteforce Execution |
test |
2023-02-04 |
| sigma |
Cisco BGP Authentication Failures |
test |
2023-01-23 |
| sigma |
Juniper BGP Missing MD5 |
test |
2023-01-23 |
| sigma |
Huawei BGP Authentication Failures |
test |
2023-01-23 |
| sigma |
Cisco LDP Authentication Failures |
test |
2023-01-09 |
| sigma |
Account Lockout |
test |
2022-12-25 |
| sigma |
User Access Blocked by Azure Conditional Access |
test |
2022-12-25 |
| sigma |
Multifactor Authentication Interrupted |
test |
2022-12-18 |
| sigma |
Hack Tool User Agent |
test |
2022-07-07 |
| sigma |
Use of Legacy Authentication Protocols |
test |
2022-06-17 |
| sigma |
Multifactor Authentication Denied |
test |
2022-03-24 |
| sigma |
NTLM Brute Force |
test |
2022-02-02 |
| sentinel |
Failed AWS Console logons but success logon to AzureAD |
Scheduled |
— |
| sentinel |
High count of failed logons by a user |
Scheduled |
— |
| sentinel |
Failed host logons but success logon to AzureAD |
Scheduled |
— |
| sentinel |
Multiple Password Reset by user |
Scheduled |
— |
| sentinel |
Failed logon attempts by valid accounts within 10 mins |
Scheduled |
— |
| sentinel |
New country signIn with correct password |
Scheduled |
— |
| sentinel |
Brute force attack against user credentials (Uses Authentication Normalization) |
Scheduled |
— |
| sentinel |
High count of failed attempts from same client IP |
Scheduled |
— |
| sentinel |
Potential Password Spray Attack (Uses Authentication Normalization) |
Scheduled |
— |
| sentinel |
Excessive number of HTTP authentication failures from a source (ASIM Web Session schema) |
Scheduled |
— |
| sentinel |
Wazuh - Large Number of Web errors from an IP |
Scheduled |
— |
| sentinel |
Failed AzureAD logons but success logon to AWS Console |
Scheduled |
— |
| sentinel |
Failed AzureAD logons but success logon to host |
Scheduled |
— |
| sentinel |
IP with multiple failed Microsoft Entra ID logins successfully logs in to Palo Alto VPN |
Scheduled |
— |