Browse Rules

[CROWDSTRIKE] Initial Access Tactic Catchall

[CROWDSTRIKE] Initial Access Tactic Catchall

[CROWDSTRIKE] Initial Access Tactic - A stale endpoint became active

[CROWDSTRIKE] Initial Access Tactic - A stale endpoint became active

[CROWDSTRIKE] Initial Access Tactic - A stale user became active

[CROWDSTRIKE] Initial Access Tactic - A stale user became active

[CROWDSTRIKE] Initial Access Tactic - A user accessed distant locations in a short timeframe

[CROWDSTRIKE] Initial Access Tactic - A user accessed distant locations in a short timeframe

[CROWDSTRIKE] Initial Access Tactic - A user performed a service access to an endpoint for the first time

[CROWDSTRIKE] Initial Access Tactic - A user performed a service access to an endpoint for the first time

[CROWDSTRIKE] Initial Access Tactic - A user performed a network login from an unusual machine

[CROWDSTRIKE] Initial Access Tactic - A user performed a network login from an unusual machine

[CROWDSTRIKE] Initial Access Tactic - A user performed a network login from an unusual number of endpoints

[CROWDSTRIKE] Initial Access Tactic - A user performed a network login from an unusual number of endpoints

[CROWDSTRIKE] Initial Access Tactic - A user performed a network login to an unusual number of endpoints

[CROWDSTRIKE] Initial Access Tactic - A user performed a network login to an unusual number of endpoints

Unauthorized Access to an Okta Application

Identifies unauthorized access attempts to Okta applications.

Kubeconfig File Creation or Modification

The kubeconfig file is a critical component in Kubernetes environments, containing configuration details for accessing and managing Kubernetes clusters. Attackers may attempt to get access to, create or modify kubeconfig files to gain unauthorized initial access to Kubernetes clusters or move laterally within the cluster.

Okta FastPass Phishing Detection

Detects when Okta FastPass prevents a user from authenticating to a phishing website.

Potential Masquerading as Business App Installer

Identifies executables with names resembling legitimate business applications but lacking signatures from the original developer. Attackers may trick users into downloading malicious executables that masquerade as legitimate applications via malicious ads, forum posts, and tutorials, effectively gaining initial access.

AWS Management Console Root Login

Identifies a successful login to the AWS Management Console by the Root user.

Github Activity on a Private Repository from an Unusual IP

Detects when there is activity on a private GitHub repository from an unusual IP address. Adversaries may access private repositories from unfamiliar IPs to exfiltrate sensitive code or data, potentially indicating a compromise or unauthorized access.

New Okta Authentication Behavior Detected

Detects events where Okta behavior detection has identified a new authentication behavior.

Google Workspace Suspended User Account Renewed

Detects when a previously suspended user's account is renewed in Google Workspace. An adversary may renew a suspended user account to maintain access to the Google Workspace organization with a valid account.

Remote Desktop File Opened from Suspicious Path

Identifies attempts to open a remote desktop file from suspicious paths. Adversaries may abuse RDP files for initial access.

Potential Remote File Execution via MSIEXEC

Identifies the execution of the built-in Windows Installer, msiexec.exe, to install a remote package. Adversaries may abuse msiexec.exe to launch local or network accessible MSI files.

Kubernetes Anonymous Request Authorized by Unusual User Agent

This rule detects when an unauthenticated user request is authorized within the cluster via an unusual user agent. Attackers may attempt to use anonymous accounts to gain initial access to the cluster or to avoid attribution of their activities within the cluster. This rule excludes the /healthz, /livez, /version and /.well-known/oauth-authorization-server endpoints which are commonly accessed anonymously.

Entra ID High Risk User Sign-in Heuristic

Identifies high risk Azure Active Directory (AD) sign-ins by leveraging Microsoft Identity Protection machine learning and heuristics.

Okta Successful Login After Credential Attack

Correlates Okta credential attack alerts with subsequent successful authentication for the same user account, identifying potential compromise following brute force, password spray, or credential stuffing attempts.

First Occurrence of Okta User Session Started via Proxy

Identifies the first occurrence of an Okta user session started via a proxy.

Multiple SonicWall Login Failures Followed by Successful Login

Identifies multiple failed SonicWall authentication attempts against several user accounts from one source IP, followed by a successful remote-access login from the same source to the same appliance. This may indicate successful password spraying, credential stuffing, or password guessing.

Deprecated - SSH Connection Established Inside A Running Container

This rule detects an incoming SSH connection established inside a running container. Running an ssh daemon inside a container should be avoided and monitored closely if necessary. If an attacker gains valid credentials they can use it to gain initial access or establish persistence within a compromised environment.

GKE Anonymous Request Authorized by Unusual User Agent

Detects successful GKE API requests from unauthenticated anonymous identities using an unusual user agent. Attackers may rely on anonymous access for initial cluster access or to avoid attribution. Matches "system:anonymous" / "system:unauthenticated" and GKE audit rows where the principal is missing (common for unauthenticated clients). Common kube-probe health checks (readyz/livez/healthz/version) are excluded.