| elastic |
Potential SSH Brute Force Detected via macOS Security Events |
production |
2026-10-06 |
| elastic |
Potential Successful SSH Brute Force Attack via macOS Security Events |
production |
2026-10-06 |
| elastic |
Privileged Accounts Brute Force |
production |
2026-10-06 |
| elastic |
Multiple Logon Failure from the same Source Address |
production |
2026-10-06 |
| splunk |
Windows Multiple Users Failed To Authenticate From Host Using NTLM |
production |
2026-10-02 |
| elastic |
Entra ID Excessive Account Lockouts Detected |
production |
2026-09-18 |
| elastic |
Entra ID ROPC Authentication with Unknown Client ID |
production |
2026-09-18 |
| elastic |
Entra ID Sign-in Brute Force Attempted (Microsoft 365) |
production |
2026-09-18 |
| elastic |
Entra ID Sign-in TeamFiltration User-Agent Detected |
production |
2026-09-18 |
| elastic |
Entra ID Protection - Risk Detection - Sign-in Risk |
production |
2026-09-18 |
| elastic |
Entra ID Protection - Risk Detection - User Risk |
production |
2026-09-18 |
| elastic |
M365 Identity User Brute Force Attempted |
production |
2026-09-18 |
| elastic |
M365 Identity User Account Lockouts |
production |
2026-09-18 |
| elastic |
Attempts to Brute Force an Okta User Account |
production |
2026-09-18 |
| elastic |
Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy |
production |
2026-09-18 |
| elastic |
Multiple Okta User Authentication Events with Same Device Token Hash |
production |
2026-09-18 |
| elastic |
Potential Okta Password Spray (Multi-Source) |
production |
2026-09-18 |
| elastic |
Potential Okta Password Spray (Single Source) |
production |
2026-09-18 |
| elastic |
Okta Successful Login After Credential Attack |
production |
2026-09-18 |
| elastic |
Potential External Linux SSH Brute Force Detected |
production |
2026-09-18 |
| elastic |
Potential Internal Linux SSH Brute Force Detected |
production |
2026-09-18 |
| elastic |
Potential Password Spraying Attack via SSH |
production |
2026-09-18 |
| elastic |
Potential Successful SSH Brute Force Attack |
production |
2026-09-18 |
| elastic |
Spike in Failed Logon Events |
production |
2026-09-18 |
| elastic |
Spike in Logon Events |
production |
2026-09-18 |
| elastic |
Spike in Successful Logon Events from a Source IP |
production |
2026-09-18 |
| elastic |
Potential SIP REGISTER Brute Force |
production |
2026-09-18 |
| elastic |
Multiple SonicWall Login Failures Followed by Successful Login |
production |
2026-09-18 |
| elastic |
Multiple Logon Failure Followed by Logon Success |
production |
2026-09-18 |
| elastic |
Entra ID User Sign-in Brute Force Attempted |
production |
2026-09-18 |
| elastic |
AWS Root Console Login Password Spraying |
production |
2026-09-18 |
| splunk |
Windows Unusual Count Of Users Fail To Auth Wth ExplicitCredentials |
production |
2026-05-13 |
| splunk |
Windows Unusual Count Of Users Failed To Auth Using Kerberos |
production |
2026-05-13 |
| splunk |
Windows Unusual Count Of Users Failed To Authenticate From Process |
production |
2026-05-13 |
| splunk |
Windows Unusual Count Of Users Remotely Failed To Auth From Host |
production |
2026-05-13 |
| splunk |
Windows Unusual NTLM Authentication Destinations By Source |
production |
2026-05-13 |
| splunk |
Windows Unusual NTLM Authentication Destinations By User |
production |
2026-05-13 |
| splunk |
Windows Unusual NTLM Authentication Users By Destination |
production |
2026-05-13 |
| splunk |
Windows Unusual NTLM Authentication Users By Source |
production |
2026-05-13 |
| splunk |
Windows Unusual Count Of Users Failed To Authenticate Using NTLM |
production |
2026-05-13 |
| splunk |
Cisco ASA - User Account Lockout Threshold Exceeded |
production |
2026-05-13 |
| splunk |
Detect Distributed Password Spray Attempts |
production |
2026-05-13 |
| splunk |
Detect Password Spray Attempts |
production |
2026-05-13 |
| splunk |
Okta Multiple Users Failing To Authenticate From Ip |
production |
2026-05-13 |
| splunk |
AWS High Number Of Failed Authentications From Ip |
production |
2026-05-13 |
| splunk |
AWS Multiple Users Failing To Authenticate From Ip |
production |
2026-05-13 |
| splunk |
AWS Unusual Number of Failed Authentications From Ip |
production |
2026-05-13 |
| splunk |
Azure Active Directory High Risk Sign-in |
production |
2026-05-13 |
| splunk |
Azure AD High Number Of Failed Authentications From Ip |
production |
2026-05-13 |
| splunk |
Azure AD Multi-Source Failed Authentications Spike |
production |
2026-05-13 |
| splunk |
Azure AD Multiple Users Failing To Authenticate From Ip |
production |
2026-05-13 |
| splunk |
Azure AD Successful Authentication From Different Ips |
production |
2026-05-13 |
| splunk |
Azure AD Unusual Number of Failed Authentications From Ip |
production |
2026-05-13 |
| splunk |
GCP Multiple Users Failing To Authenticate From Ip |
production |
2026-05-13 |
| splunk |
GCP Unusual Number of Failed Authentications From Ip |
production |
2026-05-13 |
| splunk |
O365 Multi-Source Failed Authentications Spike |
production |
2026-05-13 |
| splunk |
O365 Multiple Users Failing To Authenticate From Ip |
production |
2026-05-13 |
| splunk |
Detect Password Spray Attack Behavior From Source |
production |
2026-05-13 |
| splunk |
Detect Password Spray Attack Behavior On User |
production |
2026-05-13 |
| splunk |
Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos |
production |
2026-05-13 |
| splunk |
Windows Multiple Invalid Users Fail To Authenticate Using Kerberos |
production |
2026-05-13 |
| splunk |
Windows Multiple Invalid Users Failed To Authenticate Using NTLM |
production |
2026-05-13 |
| splunk |
Windows Multiple NTLM Null Domain Authentications |
production |
2026-05-13 |
| splunk |
Windows Multiple Users Fail To Authenticate Wth ExplicitCredentials |
production |
2026-05-13 |
| splunk |
Windows Multiple Users Failed To Authenticate From Process |
production |
2026-05-13 |
| splunk |
Windows Multiple Users Failed To Authenticate Using Kerberos |
production |
2026-05-13 |
| splunk |
Windows Multiple Users Remotely Failed To Authenticate From Host |
production |
2026-05-13 |
| splunk |
Windows Unusual Count Of Disabled Users Failed Auth Using Kerberos |
production |
2026-05-13 |
| splunk |
Windows Unusual Count Of Invalid Users Fail To Auth Using Kerberos |
production |
2026-05-13 |
| splunk |
Windows Unusual Count Of Invalid Users Failed To Auth Using NTLM |
production |
2026-05-13 |
| elastic |
Deprecated - Potential Successful Linux RDP Brute Force Attack Detected |
deprecated |
2026-02-04 |
| elastic |
Deprecated - Potential Successful Linux FTP Brute Force Attack Detected |
deprecated |
2026-02-04 |
| elastic |
Potential SSH Brute Force Detected on Privileged Account |
deprecated |
2023-06-22 |