Browse Rules

Search and filter across all detection sources

23 rules

sagan high other

[SNORT] Attempted User Privilege Gain

[SNORT] Attempted User Privilege Gain
sagan high other

[HUAWEI] HTTPD - OUT

[HUAWEI] HTTPD - OUT
sagan high other

[HUAWEI] HTTPD - PASS

[HUAWEI] HTTPD - PASS
sagan high other

[RSYNC] Authentication failure

[RSYNC] Authentication failure
sagan high other

[KEY9] Unauthorized Access Attempted

[KEY9] Unauthorized Access Attempted
sagan high other

[CISCO-MERAKI] WPA failed authentication attempt

[CISCO-MERAKI] WPA failed authentication attempt
sagan high other

[CISCO-MERAKI] WPA failed authentication attempt

[CISCO-MERAKI] WPA failed authentication attempt
sagan high other

[DUO] Authentication - Brute Force [4/5]

[DUO] Authentication - Brute Force [4/5]
sagan high other

[SCREENCONNECT] Connection from Outside HOME_COUNTRY

[SCREENCONNECT] Connection from Outside HOME_COUNTRY
sagan high other

[CISCO-MERAKI] IP Conflicts - Martian SRC Detected

[CISCO-MERAKI] IP Conflicts - Martian SRC Detected
sagan high other

[CISCO-MERAKI] WIPS Mac Spoofing Attack Detected

[CISCO-MERAKI] WIPS Mac Spoofing Attack Detected
sagan high other

[DUO] MFA Authentication Attempt from Outside HOME_COUNTRY

[DUO] MFA Authentication Attempt from Outside HOME_COUNTRY
sagan high other

[AWS-SIGNIN] Multiple Failed Console Login Attempts - Brute Force

[AWS-SIGNIN] Multiple Failed Console Login Attempts - Brute Force
sagan high other

[PALO-ALTO] GlobalProtect VPN Successful Login After Brute Force

[PALO-ALTO] GlobalProtect VPN Successful Login After Brute Force
sagan high other

[HONEYD] Attempt to login to honeypot FTP server [0/10]

[HONEYD] Attempt to login to honeypot FTP server [0/10]
sagan high other

[HONEYD] Attempt to login to honeypot Telnet server [0/10]

[HONEYD] Attempt to login to honeypot Telnet server [0/10]
sagan high other

[PALO-ALTO] GlobalProtect VPN Successful Login from Outside HOME_COUNTRY

[PALO-ALTO] GlobalProtect VPN Successful Login from Outside HOME_COUNTRY
sagan high other

[SCREENCONNECT] Bluedot Detected a Connection from a Malicious IP Address

[SCREENCONNECT] Bluedot Detected a Connection from a Malicious IP Address
sagan high other

[AZURE-EVENTHUB] Microsoft SQL Authentication Failure - Possible Brute Force [10/1]

[AZURE-EVENTHUB] Microsoft SQL Authentication Failure - Possible Brute Force [10/1]
sagan high other

[CISCO-MERAKI] 802.1x EAP(RADIUS) failed authentication attempt [10/5]

[CISCO-MERAKI] 802.1x EAP(RADIUS) failed authentication attempt [10/5]
sagan high other

[CISCO-MERAKI] 802.1x EAP(RADIUS) failed authentication attempt [10/5]

[CISCO-MERAKI] 802.1x EAP(RADIUS) failed authentication attempt [10/5]
sagan high other

[PALO-ALTO] GlobalProtect VPN Authentication Failed Possible Brute-Force [10/1]

[PALO-ALTO] GlobalProtect VPN Authentication Failed Possible Brute-Force [10/1]
elastic medium kql

Azure AKS Attempted User Exec into Pod

Detects an AKS (Azure Kubernetes Service) identity establishing an exec session into a pod. Interactive command execution inside a workload via kubectl exec is a common post-compromise technique used to access secrets, run tooling, and expand access from a foothold container. Node, control-plane, and kube-system service account identities are excluded, so workload service accounts and users, the identities an adversary is most likely to abuse, remain in scope.