| sigma |
HackTool - GoldenDMSA Execution |
experimental |
2026-10-19 |
| sigma |
Potential Kerberos Pre-Authentication Failure for Machine Accounts |
experimental |
2026-10-19 |
| elastic |
Potential Successful SSH Brute Force Attack via macOS Security Events |
production |
2026-10-06 |
| elastic |
Potential SSH Brute Force Detected via macOS Security Events |
production |
2026-10-06 |
| elastic |
Multiple Logon Failure from the same Source Address |
production |
2026-10-06 |
| elastic |
Privileged Accounts Brute Force |
production |
2026-10-06 |
| elastic |
Excessive Sudo Authentication Failures via macOS Security Events |
production |
2026-10-06 |
| elastic |
ESXi Multiple Logon Failures by User and Source |
production |
2026-09-30 |
| elastic |
Potential External Linux SSH Brute Force Detected |
production |
2026-09-18 |
| elastic |
Entra ID Sign-in Brute Force Attempted (Microsoft 365) |
production |
2026-09-18 |
| elastic |
Entra ID MFA TOTP Brute Force Attempted |
production |
2026-09-18 |
| elastic |
M365 Identity User Brute Force Attempted |
production |
2026-09-18 |
| elastic |
M365 Identity User Account Lockouts |
production |
2026-09-18 |
| elastic |
Attempts to Brute Force an Okta User Account |
production |
2026-09-18 |
| elastic |
Potential Okta Brute Force (Device Token Rotation) |
production |
2026-09-18 |
| elastic |
Potential Okta Brute Force (Multi-Source) |
production |
2026-09-18 |
| elastic |
Okta Successful Login After Credential Attack |
production |
2026-09-18 |
| elastic |
Potential Linux Local Account Brute Force Detected |
production |
2026-09-18 |
| elastic |
Potential Internal Linux SSH Brute Force Detected |
production |
2026-09-18 |
| elastic |
Potential Password Spraying Attack via SSH |
production |
2026-09-18 |
| elastic |
Potential Successful SSH Brute Force Attack |
production |
2026-09-18 |
| elastic |
Potential Linux Hack Tool Launched |
production |
2026-09-18 |
| elastic |
Spike in Failed Logon Events |
production |
2026-09-18 |
| elastic |
Potential SIP REGISTER Brute Force |
production |
2026-09-18 |
| elastic |
Multiple SonicWall Login Failures Followed by Successful Login |
production |
2026-09-18 |
| elastic |
Multiple Logon Failure Followed by Logon Success |
production |
2026-09-18 |
| elastic |
AWS Management Console Brute Force of Root User Identity |
production |
2026-09-18 |
| elastic |
Entra ID User Sign-in Brute Force Attempted |
production |
2026-09-18 |
| elastic |
Entra ID Excessive Account Lockouts Detected |
production |
2026-09-18 |
| splunk |
CrushFTP Max Simultaneous Users From IP |
production |
2026-09-08 |
| splunk |
Azure AD High Number Of Failed Authentications For User |
production |
2026-05-13 |
| splunk |
Azure AD High Number Of Failed Authentications From Ip |
production |
2026-05-13 |
| splunk |
Azure AD Successful Authentication From Different Ips |
production |
2026-05-13 |
| splunk |
High Number of Login Failures from a single source |
production |
2026-05-13 |
| splunk |
O365 High Number Of Failed Authentications for User |
production |
2026-05-13 |
| splunk |
Windows Remote Desktop Network Bruteforce Attempt |
production |
2026-05-13 |
| splunk |
AWS Credential Access GetPasswordData |
production |
2026-05-13 |
| splunk |
AWS Credential Access Failed Login |
production |
2026-05-13 |
| splunk |
ASL AWS Credential Access GetPasswordData |
production |
2026-05-13 |
| splunk |
Cisco ASA - User Account Lockout Threshold Exceeded |
production |
2026-05-13 |
| elastic |
Deprecated - Potential Successful Linux RDP Brute Force Attack Detected |
deprecated |
2026-02-04 |
| elastic |
Deprecated - Potential Successful Linux FTP Brute Force Attack Detected |
deprecated |
2026-02-04 |
| elastic |
Potential SSH Brute Force Detected on Privileged Account |
deprecated |
2023-06-22 |
| sigma |
HackTool - Hydra Password Bruteforce Execution |
test |
2023-02-04 |
| sigma |
Suspicious Rejected SMB Guest Logon From IP |
test |
2023-01-02 |
| sigma |
Suspicious Connection to Remote Account |
test |
2021-12-27 |