Browse Rules

Snowflake Brute Force Attacks by Username

Detect brute force attacks by monitoring for failed logins by the same username

Brute Force By IP

An actor user was denied login access more times than the configured threshold.

Brute Force By User

An actor user was denied login access more times than the configured threshold.

Snowflake Brute Force Attacks by IP

Detect brute force attacks by monitoring for failed logins from the same IP address

Snowflake Brute Force Attacks by IP

Detect brute force attacks by monitorign failed logins from the same IP address

Snowflake Brute Force Attacks by User

Detect brute force attacks by monitorign failed logins from the same IP address

Teleport SSH Auth Errors

A high volume of SSH errors could indicate a brute-force attack

[WINDOWS-SECURITY] Authentication - Anonymous NTLM V1 Logon After Brute Force

[WINDOWS-SECURITY] Authentication - Anonymous NTLM V1 Logon After Brute Force

OneLogin User Locked

User locked or suspended from their account.

Failed Root Console Login

A Root console login failed.

Databricks Repeated Failed Login Attempts

Detects repeated failed login attempts within a 60-minute window, which may indicate credential stuffing, brute force attacks, or compromised credentials.

Okta Rate Limits

Potential DoS/Bruteforce attack or hitting limits (system degradation)

M365 Identity User Brute Force Attempted

Identifies brute-force authentication activity targeting Microsoft 365 user accounts using failed sign-in patterns that match password spraying, credential stuffing, or password guessing behavior. Adversaries may attempt brute-force authentication with credentials obtained from previous breaches, leaks, marketplaces or guessable passwords.

GSuite User Device Unlock Failures

Someone failed to unlock a user's device multiple times in quick succession.

Azure Excessive Account Lockouts

Detects high volumes of failed Microsoft Entra ID sign-in attempts resulting in account lockouts, indicating potential brute-force credential attacks such as password spraying, password guessing, or credential stuffing. When adversaries repeatedly attempt authentication with incorrect credentials, Entra ID Smart Lockout policies trigger account lockouts (error code 50053).

AWS Password Policy Complexity Guidelines

This policy validates that the account password policy enforces the recommended password complexity requirements.

AWS IAM User MFA

This policy validates that all AWS IAM users with access to the AWS Console have Multi-Factor Authentication (MFA) enabled.

OpenAI Brute Force Login Success

Detects successful credential stuffing or brute force attacks against OpenAI accounts. This rule identifies when a user account experiences 5 or more failed login attempts followed by a successful login within 30 minutes. This pattern indicates: - Successful credential stuffing attack - Successful brute force attack - Compromised user credentials - Automated attack tools successfully gaining access The correlation is performed by matching on the user email address to track attempts against the s

AWS Password Policy Password Age Limit

This policy validates that the account password policy enforces a maximum password age of 90 days or less.

Carbon Black Log Entry Flagged

Detects when Carbon Black has flagged a log as important, such as failed login attempts and locked accounts.

Potential Okta Brute Force (Device Token Rotation)

Detects potential brute force attacks against a single Okta user account where excessive unique device token hashes are generated, indicating automated tooling that fails to persist browser cookies between attempts.

Potential Okta Brute Force (Multi-Source)

Detects potential brute force attacks against a single Okta user account from multiple source IPs, indicating attackers rotating through proxy infrastructure to evade IP-based detection.

AWS Password Policy Password Reuse

This policy validates that the account password policy prevents users from re-using previous passwords, and prevents password reuse for 24 or more prior passwords.

Snowflake Password Spray

Detects password spraying attacks against Snowflake by tracking the number of distinct user accounts targeted by failed login attempts from the same source IP address within a short timeframe. Unlike brute force against a single account, password spraying distributes attempts across many accounts to evade lockout policies. This rule complements Snowflake.Stream.BruteForceByIp (same IP, any accounts) and Snowflake.PotentialBruteForceSuccess.Group (brute force followed by confirmed login).

Potential External Linux SSH Brute Force Detected

Identifies multiple external consecutive login failures targeting a user account from the same source address within a short time interval. Adversaries will often brute force login attempts across multiple users with a common or known password, in an attempt to gain access to these accounts.