Brute Force detection rulesT1110

Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.

windows

Detects suspicious user agent strings user by hack tools in proxy logs

proxy

This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.

windows · process_creation

Execute Hashcat.exe with provided SAM file from registry of Windows and Password list to crack against

windows · process_creation

Detects command line parameters used by Hydra password guessing hack tool

windows · process_creation

Indicates that a password spray attack has been successfully performed.

azure

Detects successful authentication from potential clients using legacy authentication via user agent strings. This could be a sign of MFA bypass using a password spray attack.

azure

Define a baseline threshold for failed sign-ins due to Conditional Access failures

azure

Alert on when legacy authentication has been used on an account

azure

Identifies user account which has been locked because the user tried to sign in too many times with an incorrect user ID or password.

azure

Detects failed AWS console login attempts due to authentication failures. Monitoring these events is crucial for identifying potential brute-force attacks or unauthorized access attempts to AWS accounts.

aws

Detects user authentication failure events. Please note that this rule can be noisy and it is recommended to use with correlation based on "author.name" field.

bitbucket

Detects SSH user login access failures. Please note that this rule can be noisy and is recommended to use with correlation based on "author.name" field.

bitbucket

Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.

windows

Detects failed logon attempts from clients with external network IP to an MSSQL server. This can be a sign of a bruteforce attack.

windows

User has indicated they haven't instigated the MFA prompt and could indicate an attacker has the password for the account.

azure

Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge.

azure

Detects common NTLM brute force device names

windows

Detect successful authentications from countries you do not operate out of.

azure

Detect Attempt PrintNightmare (CVE-2021-1675) Remote code execution in Windows Spooler Service

windows

Detect access has been blocked by Conditional Access policies. The access policy does not allow token issuance which might be sights≈ of unauthorizeed login to valid accounts.

azure

Detects BGP failures which may be indicative of brute force attacks to manipulate routing

cisco

Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels

cisco

Detect failed authentications from countries you do not operate out of.

azure

Detects BGP failures which may be indicative of brute force attacks to manipulate routing.

huawei

Detects juniper BGP missing MD5 digest. Which may be indicative of brute force attacks to manipulate routing.

juniper

Detects failed logon attempts from clients to MSSQL server.

windows

Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism

windows · ps_script