Deterministic Detection Rules

Inspection of deterministic security rules executed against ingested logs. All rules are deterministic, explainable, and mapped to the MITRE ATT&CK framework.

RULE_BRUTE_FORCE_USERRepeated Failed Logins (Brute Force Attempt)HIGH
+35 Risk Contribution

Triggers when a single user account or IP origin experiences multiple consecutive failed authentication events within a configured sliding time window.

Threshold Conditions
≥ 4 failures within 15 minutes
MITRE ATT&CK Technique
T1110.001 (Password Guessing)
False Positive Considerations
Can trigger on legitimate users mistyping passwords, an expired cached token in a local client, or an unupdated service account.
RULE_PASSWORD_SPRAY_IPDistributed Password Spraying PatternHIGH
+40 Risk Contribution

Identifies a single source IP attempting failed logins across multiple distinct corporate accounts, evading per-account lockout policies.

Threshold Conditions
≥ 3 distinct usernames targeted from 1 IP within 15 minutes
MITRE ATT&CK Technique
T1110.003 (Password Spraying)
False Positive Considerations
May trigger when multiple employees connect via a single shared corporate VPN or office NAT gateway after an organization-wide password rotation.
RULE_SUCCESS_AFTER_FAILURESSuccessful Authentication Following Multiple FailuresCRITICAL
+55 Risk Contribution

Signals potential account takeover: an account achieves a successful login immediately following a sequence of failed authentication attempts.

Threshold Conditions
≥ 3 failures followed by SUCCESS within 30 minutes
MITRE ATT&CK Technique
T1078 (Valid Accounts / Account Takeover)
False Positive Considerations
A user who forgot their password may have succeeded on the 4th attempt or recovered their credentials from a manager.
RULE_REPEATED_ACCESS_DENIEDRepeated Authorization / Access Denied EventsMEDIUM
+25 Risk Contribution

Detects multiple access-denied or authorization-blocked events in succession, indicating an active permission probe or unauthorized access attempt.

Threshold Conditions
≥ 3 DENIED events within 15 minutes
MITRE ATT&CK Technique
T1068 (Exploitation for Privilege Escalation)
False Positive Considerations
Can occur when a developer or contractor with newly revoked permissions attempts to execute an existing automated script.
RULE_SUSPICIOUS_POST_COMPROMISEHigh-Impact Action After Authentication AnomalyCRITICAL
+50 Risk Contribution

Detects sensitive operations (DATA_EXPORT, ADMIN_ROLE_ADD, KEY_ACCESS) executed shortly after authentication failures or credential anomalies.

Threshold Conditions
High-privilege event within 60 minutes following ≥ 2 prior login failures
MITRE ATT&CK Technique
T1020 (Automated Exfiltration / Lateral Movement)
False Positive Considerations
Legitimate system administrator who made authentication typos before performing scheduled operational tasks.