https://logtriage.app/ Validated Sigma detection rules (each proven to fire on a real malicious log sample and stay silent on a benign one), investigator-focused reference pages for error codes and log formats, a monthly data report on what attacks an internet-facing server, and engineering notes. en Mon, 12 Oct 2026 00:00:00 GMT https://logtriage.app/rules/azure-activity-privilege-escalation-sabotage/ https://logtriage.app/rules/azure-activity-privilege-escalation-sabotage/ A validated Sigma rule that flags Azure ARM control-plane sabotage — granting a new role assignment, deleting a Key Vault secret, or deleting a VM, the three highest-impact actions an attacker takes once inside a subscription. Detection Rules Mon, 12 Oct 2026 00:00:00 GMT https://logtriage.app/rules/aws-waf-managed-rule-exploit-block/ https://logtriage.app/rules/aws-waf-managed-rule-exploit-block/ A validated Sigma rule that flags AWS WAF terminating a request via a managed rule group — SQL injection, Log4Shell/JNDI RCE, or cross-site scripting — a confirmed exploit attempt even though the request never reached your app. Detection Rules Mon, 12 Oct 2026 00:00:00 GMT https://logtriage.app/reference/log-formats/sysmon/ https://logtriage.app/reference/log-formats/sysmon/ Field-by-field reference for Microsoft Sysmon XML events: EventID, Image, CommandLine, SourceImage, TargetImage, GrantedAccess — with samples and parsing pitfalls. Reference Thu, 08 Oct 2026 00:00:00 GMT https://logtriage.app/reference/log-formats/okta/ https://logtriage.app/reference/log-formats/okta/ Field-by-field reference for Okta System Log events: eventType, outcome.result, outcome.reason, actor, client.ipAddress and securityContext, with real sample records. Reference Thu, 08 Oct 2026 00:00:00 GMT https://logtriage.app/reference/log-formats/k8s-audit/ https://logtriage.app/reference/log-formats/k8s-audit/ Field-by-field reference for Kubernetes API server audit events — verb, requestURI, user.username, objectRef and responseStatus — with sample records and detection tips. Reference Thu, 08 Oct 2026 00:00:00 GMT https://logtriage.app/reference/log-formats/duo/ https://logtriage.app/reference/log-formats/duo/ Field reference for Duo Security logs: result, factor, reason, user, access_device and application, with sample records and MFA fatigue detection ideas. Reference Thu, 08 Oct 2026 00:00:00 GMT https://logtriage.app/reports/server-attacks/2026-09/ https://logtriage.app/reports/server-attacks/2026-09/ Monthly data report from LogTriage's own production server: SSH brute force, web probes, attacking networks and tools, aggregated. Reports Tue, 06 Oct 2026 14:53:47 GMT https://logtriage.app/reference/log-formats/vpc-flow/ https://logtriage.app/reference/log-formats/vpc-flow/ AWS VPC Flow Logs default format explained field by field — srcaddr, dstport, action, log-status — with example records and how to spot scans and exfiltration. Reference Tue, 06 Oct 2026 00:00:00 GMT https://logtriage.app/reference/log-formats/crowdstrike/ https://logtriage.app/reference/log-formats/crowdstrike/ Field-by-field reference for CrowdStrike Falcon sensor events: event_simpleName, aid, cid, ProcessRollup2, NetworkConnectIP4 and DetectionSummaryEvent, with samples. Reference Tue, 06 Oct 2026 00:00:00 GMT https://logtriage.app/reference/log-formats/azure-ad-signin/ https://logtriage.app/reference/log-formats/azure-ad-signin/ Field-by-field reference for Entra ID (Azure AD) sign-in logs: status.errorCode, clientAppUsed, Conditional Access, device and location, with a sample record. Reference Tue, 06 Oct 2026 00:00:00 GMT https://logtriage.app/reference/logon-failure-codes/0xc0000234/ https://logtriage.app/reference/logon-failure-codes/0xc0000234/ Status 0xC0000234 in Windows event 4625 means the account is locked out. Find what locked it with event 4740 and decide whether it was an attack or a stale password. Reference Tue, 06 Oct 2026 00:00:00 GMT https://logtriage.app/reference/logon-failure-codes/0xc000006d/ https://logtriage.app/reference/logon-failure-codes/0xc000006d/ Status 0xC000006D in Windows event 4625 means the logon was invalid — a bad username or bad authentication information. How to read Sub Status and triage it. Reference Tue, 06 Oct 2026 00:00:00 GMT https://logtriage.app/reference/logon-failure-codes/0xc000006a/ https://logtriage.app/reference/logon-failure-codes/0xc000006a/ Sub Status 0xC000006A in event 4625 means the account exists but the password was wrong. How to spot brute force and spraying, with KQL to group failures. Reference Tue, 06 Oct 2026 00:00:00 GMT https://logtriage.app/reference/aadsts/50126/ https://logtriage.app/reference/aadsts/50126/ AADSTS50126 means Entra ID rejected the username or password. How to tell a typo from password spraying, plus KQL to find the source IPs behind it. Reference Tue, 06 Oct 2026 00:00:00 GMT https://logtriage.app/reference/logon-failure-codes/0xc0000064/ https://logtriage.app/reference/logon-failure-codes/0xc0000064/ Sub Status 0xC0000064 in Windows event 4625 means the username does not exist. Why bursts signal username guessing and how to trace the source host. Reference Tue, 06 Oct 2026 00:00:00 GMT https://logtriage.app/reference/aadsts/53003/ https://logtriage.app/reference/aadsts/53003/ AADSTS53003 means a Conditional Access policy blocked token issuance. Policies apply after the first factor, so an unexpected block can expose a known password. Reference Tue, 06 Oct 2026 00:00:00 GMT https://logtriage.app/reference/aadsts/50076/ https://logtriage.app/reference/aadsts/50076/ AADSTS50076 means Entra ID accepted the password but required MFA. Why it matters when it comes from scripts or legacy mail clients, and how to triage it. Reference Tue, 06 Oct 2026 00:00:00 GMT https://logtriage.app/reference/aadsts/50074/ https://logtriage.app/reference/aadsts/50074/ AADSTS50074 means the password was correct but the MFA challenge was not passed. When it is a routine prompt and when it means an attacker has the password. Reference Tue, 06 Oct 2026 00:00:00 GMT https://logtriage.app/reference/aadsts/50053/ https://logtriage.app/reference/aadsts/50053/ AADSTS50053 means Entra ID smart lockout locked the account or blocked a malicious IP. How to tell which happened and how to find the attack behind it. Reference Tue, 06 Oct 2026 00:00:00 GMT https://logtriage.app/rules/aws-alb-scanner-scripted-access/ https://logtriage.app/rules/aws-alb-scanner-scripted-access/ A validated Sigma rule that flags sqlmap and other scanner signatures, plus scripted HTTP clients (python-requests, axios) reaching admin, login, or export paths in AWS ALB/ELB access logs. Detection Rules Tue, 06 Oct 2026 00:00:00 GMT https://logtriage.app/rules/aws-config-security-control-tampering/ https://logtriage.app/rules/aws-config-security-control-tampering/ A validated Sigma rule that flags IAM security-policy deletion, security groups opened to 0.0.0.0/0, and CloudTrail trail deletion in AWS Config configuration-item history. Detection Rules Tue, 06 Oct 2026 00:00:00 GMT https://logtriage.app/rules/zeek-http-web-attack-recon/ https://logtriage.app/rules/zeek-http-web-attack-recon/ A validated Sigma rule that flags sensitive-file probing (.env, wp-admin, config.php), SQL injection, and attack tooling in Zeek (Bro) http.log network telemetry. Detection Rules Fri, 18 Sep 2026 00:00:00 GMT https://logtriage.app/rules/s3-anonymous-access-exfiltration/ https://logtriage.app/rules/s3-anonymous-access-exfiltration/ A validated Sigma rule that flags unauthenticated (ANONYMOUS) object downloads from S3 buckets and script uploads into them, using S3 server access logs. Detection Rules Fri, 18 Sep 2026 00:00:00 GMT https://logtriage.app/rules/nginx-sqli-data-exfiltration/ https://logtriage.app/rules/nginx-sqli-data-exfiltration/ A validated Sigma rule that flags SQL injection probing — UNION SELECT, boolean tests, time-based payloads, and sqlmap tooling — in nginx and Apache access logs. Detection Rules Fri, 18 Sep 2026 00:00:00 GMT https://logtriage.app/rules/google-workspace-admin-takeover/ https://logtriage.app/rules/google-workspace-admin-takeover/ A validated Sigma rule that flags Google Workspace admin takeover — super-admin role grants, two-step-verification being disabled for users, and suspicious logins in the Admin Reports API. Detection Rules Fri, 18 Sep 2026 00:00:00 GMT https://logtriage.app/rules/windows-4625-password-spray/ https://logtriage.app/rules/windows-4625-password-spray/ A validated Sigma rule that flags password spraying and brute force against Windows and Active Directory using failed-logon Event ID 4625 and its SubStatus codes. Detection Rules Tue, 04 Aug 2026 00:00:00 GMT https://logtriage.app/rules/github-audit-org-takeover/ https://logtriage.app/rules/github-audit-org-takeover/ A validated Sigma rule that flags GitHub org takeover — 2FA being disabled, repos destroyed, backdoor members added, and webhooks planted for source-code exfiltration. Detection Rules Tue, 04 Aug 2026 00:00:00 GMT https://logtriage.app/rules/duo-mfa-fatigue-bypass/ https://logtriage.app/rules/duo-mfa-fatigue-bypass/ A validated Sigma rule that flags MFA push-bombing, user-reported fraud, and bypass-code abuse in Duo Security authentication logs. Detection Rules Tue, 04 Aug 2026 00:00:00 GMT https://logtriage.app/rules/authlog-ssh-brute-force/ https://logtriage.app/rules/authlog-ssh-brute-force/ A validated Sigma rule that flags SSH brute-force and username-enumeration attacks in Linux auth.log — repeated Failed password and Invalid user events from one source. Detection Rules Tue, 04 Aug 2026 00:00:00 GMT https://logtriage.app/rules/okta-credential-stuffing/ https://logtriage.app/rules/okta-credential-stuffing/ A validated Sigma rule that flags credential stuffing in the Okta System Log — a burst of failed sign-ins from one source, ending in a lockout or a success. Detection Rules Wed, 01 Jul 2026 00:00:00 GMT https://logtriage.app/rules/k8s-secret-exfiltration/ https://logtriage.app/rules/k8s-secret-exfiltration/ A validated Sigma rule that flags Kubernetes secret exfiltration — get/list access to Secrets from an unexpected user or service account in the K8s audit log. Detection Rules Wed, 01 Jul 2026 00:00:00 GMT https://logtriage.app/rules/gcp-iam-privilege-escalation/ https://logtriage.app/rules/gcp-iam-privilege-escalation/ A validated Sigma rule that flags GCP privilege escalation — SetIamPolicy, service-account key creation, and custom role creation by an unexpected principal. Detection Rules Wed, 01 Jul 2026 00:00:00 GMT https://logtriage.app/rules/cloudflare-path-traversal-recon/ https://logtriage.app/rules/cloudflare-path-traversal-recon/ A validated Sigma rule that flags path traversal and sensitive-file probing in Cloudflare logs — /etc/passwd, .env, and directory-traversal attempts against your edge. Detection Rules Wed, 01 Jul 2026 00:00:00 GMT https://logtriage.app/rules/vpc-flow-port-scanning/ https://logtriage.app/rules/vpc-flow-port-scanning/ A validated Sigma rule that flags port scanning in AWS VPC Flow Logs — REJECT-heavy connection bursts from a single source across many destination ports. Detection Rules Tue, 23 Jun 2026 00:00:00 GMT https://logtriage.app/rules/m365-bec-inbox-rule/ https://logtriage.app/rules/m365-bec-inbox-rule/ A validated Sigma rule that flags business email compromise in the Microsoft 365 Unified Audit Log — attacker-created inbox rules and mailbox forwarding used to hide and exfiltrate mail. Detection Rules Tue, 23 Jun 2026 00:00:00 GMT https://logtriage.app/rules/azure-legacy-auth-mfa-bypass/ https://logtriage.app/rules/azure-legacy-auth-mfa-bypass/ A validated Sigma rule that flags legacy authentication protocols in Azure AD / Entra sign-in logs — the most common way attackers sidestep MFA and conditional access. Detection Rules Tue, 23 Jun 2026 00:00:00 GMT https://logtriage.app/rules/sysmon-lsass-credential-dumping/ https://logtriage.app/rules/sysmon-lsass-credential-dumping/ A validated Sigma rule that flags LSASS credential-dumping attempts in Sysmon — process access to lsass.exe with credential-theft access masks, the core technique behind Mimikatz and most hands-on-keyboard intrusions. Detection Rules Mon, 22 Jun 2026 00:00:00 GMT https://logtriage.app/rules/nginx-credential-stuffing/ https://logtriage.app/rules/nginx-credential-stuffing/ A validated Sigma rule that flags credential-stuffing campaigns in nginx and web-server access logs — high-volume failed logins from a single source against your auth endpoint, followed by a success. Detection Rules Mon, 22 Jun 2026 00:00:00 GMT https://logtriage.app/rules/cloudtrail-iam-privilege-escalation/ https://logtriage.app/rules/cloudtrail-iam-privilege-escalation/ A validated Sigma rule that flags IAM privilege-escalation activity in AWS CloudTrail — policy attachment, inline policy injection, and password-policy tampering by an unexpected principal. Detection Rules Mon, 22 Jun 2026 00:00:00 GMT https://logtriage.app/blog/single-ti-hit-should-spike-score/ https://logtriage.app/blog/single-ti-hit-should-spike-score/ Why additive risk scoring under-reacts to a single confirmed-malicious threat intelligence verdict, and how a floor rule fixes it. Blog Wed, 17 Jun 2026 00:00:00 GMT https://logtriage.app/blog/impossible-travel-detection/ https://logtriage.app/blog/impossible-travel-detection/ Impossible travel detection doesn't need a UEBA platform — haversine distance and elapsed time on sign-in coordinates is enough. Blog Wed, 17 Jun 2026 00:00:00 GMT https://logtriage.app/blog/context-aware-risk-scoring/ https://logtriage.app/blog/context-aware-risk-scoring/ Context-aware risk scoring explained: why the same user-agent string can be low risk on one endpoint and critical on another. Blog Wed, 17 Jun 2026 00:00:00 GMT