Search and filter across all detection sources
5,388 rules
[ONELOGIN] USER_ASSUMED_USER
OneLogin User Assumed Another User
Detects when an user assumed another user account.
[DOVECOT] Invalid username
AWS KMS: [$(aws.eventName)] $(aws.userIdentity.type) - $(aws.userIdentity.userName) - $(aws.sourceIPAddress)
[APACHE] User authentication failed
[HUAWEI] USER_NOT_EXIST
[IMAPD] User login failed
[MCAS] ALERT_ADMIN_USER
[MCAS] ALERT_ZOMBIE_USER
[WATCHGUARD] VPN - User login
User assumed another user account
Bitglass - User Agent string has changed for user
'Detects when User Agent string has changed for user.'
Super user
Detects when a user is assigned super user privileges.
Atlassian admin impersonated another user
Reports when an Atlassian user logs in (impersonates) another user.
[DUO] user authentication failed due to unenrolled user
[WINDOWS-SECURITY] User Created with Net User Command
User Added To Root/Sudoers Group Using Usermod
Detects usage of the "usermod" binary to add users add users to the root or suoders groups
OneLogin Multiple Users Assumed
Detects when a user assumes multiple user accounts.
[HUAWEI] FTPS - USERIN Login failed
[MCAS] ALERT_PERSONAL_USER_SAGE
[MYSQL] Access denied for user
[NETWRIX] Active Directory User Added
[PRISMA] Prisma Access User Registered