Free Security Log Analyzer

Sign-in succeeded after repeated failures

A successful sign-in from an IP that, in the previous 24 h, failed ≥5 times or for ≥2 different accounts, with failures making up ≥50% of its attempts · high when the source is a private address

Password spray

One IP fails sign-in (AADSTS50126, 50034, 50053 or 50056) for ≥5 distinct accounts within 24 h

Brute force against one account

≥10 failed sign-ins (bad password, unknown user, locked) for one account within 24 h

Correct password, MFA not completed

AADSTS50074, 50076, 50079, 50072 or 500121 with no successful sign-in for the same user and IP within 10 min

Legacy authentication protocol used

clientAppUsed is a legacy protocol (IMAP4, POP3, Authenticated SMTP, Exchange ActiveSync, Exchange Web Services, MAPI, Other clients…) or the user agent contains BAV2ROPC · medium when every legacy attempt failed

Impossible travel

Consecutive sign-ins by one account ≥500 km apart at an implied speed above 1,000 km/h (needs coordinates in the export)

One account used from several countries

Sign-ins where the password was accepted, for one account, from ≥3 countries within 24 h

Risky sign-in succeeded

Successful sign-in with riskLevelDuringSignIn or riskLevelAggregated of medium/high, or riskState atRisk / confirmedCompromised · medium for medium risk

Smart lockout triggered

Any AADSTS50053 (account locked after repeated failures, or sign-in from a known-malicious IP blocked)

Blocked by Conditional Access

Any AADSTS53003

Network or RDP logon succeeded after repeated failures

4624 with LogonType 3 or 10 from an IP that had ≥5 failed logons (4625/4771) in the previous 24 h, failures being ≥50% of its attempts · high when the source is a private address

Password spray (4625)

Failed logons (4625/4771) from one IP against ≥5 distinct accounts within 24 h

Brute force against one account (4625)

≥10 failed logons for one account within 24 h

Username enumeration (SubStatus 0xC0000064)

≥5 failed logons for accounts that do not exist (4625 SubStatus 0xC0000064, 4776 0xC0000064, 4771 0x6) from one source

Account lockouts (4740)

Any 4740 event · high when ≥3 accounts lock out

Audit log cleared

Event 1102 (Security log cleared) or 104 (event log cleared)

User account created (4720)

Any 4720 event

Account added to a privileged group

4728, 4732 or 4756 adding a member to Domain Admins, Enterprise Admins, Schema Admins, Administrators, Account/Backup/Server Operators, DnsAdmins or similar · critical when the added account was created in the same log

Suspicious scheduled task created (4698)

4698 whose task XML runs encoded PowerShell, a download cradle, a LOLBin download, or a binary from a temp or public folder

Suspicious service installed

4697 or 7045 whose service binary runs a command shell, encoded PowerShell, or a binary from ADMIN$ or a temp or public folder

Suspicious command line (4688)

Process command lines matching credential dumping, shadow-copy deletion, encoded PowerShell, download cradles, LOLBin downloads, log clearing, Defender tampering or AD reconnaissance · per pattern: critical for credential dumping or backup deletion, medium for AD reconnaissance

SSH login accepted after repeated failures

"Accepted …" from an IP that had ≥5 failed authentications in the previous 24 h, failures being ≥50% of its attempts · high when the source is a private address

SSH brute force

≥10 failed SSH authentications (failed password or invalid user) from one IP within 24 h

SSH username enumeration

≥5 distinct non-existent usernames tried from one IP

Direct root login over SSH

"Accepted … for root" · high when authenticated by password

sudo / su authentication failures

pam_unix(sudo|su:auth) failures, "incorrect password attempts" and "user NOT in sudoers"; medium at ≥3 per user or any NOT-in-sudoers refusal · low when a user has fewer than 3 failures and none were refused as "NOT in sudoers"

Suspicious command run with sudo

sudo COMMAND= lines that download from raw IPs, pipe downloads into a shell, make /tmp files executable, open reverse shells, write to authorized_keys, or tamper with history and logs · per pattern: low for a root shell or account change, medium for piped installers and executables in /tmp, high for raw-IP downloads, reverse shells, key planting and log tampering

Local account created or given admin rights

useradd "new user", usermod/gpasswd adding a user to a group · high when a user is added to sudo, wheel, docker or a similar group

Login succeeded after repeated rejections

A 2xx response to a POST on a login endpoint from an IP that had ≥5 rejected (401/403) login POSTs in the previous 24 h, rejections being ≥50% of its login attempts · high when the source is a private address

Credential stuffing against a login endpoint

One IP sends ≥20 login POSTs of which ≥60% are rejected (401/403), or ≥10 rejected login POSTs within 5 min

Injection payloads in requests

SQL injection, XSS, path traversal, command injection, Log4Shell, Shellshock or cloud-metadata SSRF patterns in the URL (decoded), user agent or referer

Attack tool user agent

User agent of a known offensive tool: sqlmap, Nuclei, Hydra, commix, Nikto, Nmap, masscan, ZGrab, gobuster, DirBuster, WPScan, ffuf, wfuzz, Acunetix and others · medium for discovery scanners (Nikto, Nmap, gobuster…), high for exploitation tools (sqlmap, Nuclei, Hydra…)

Probing for sensitive files and admin panels

One IP requests ≥3 kinds of sensitive path (.env, .git, backups, phpinfo, actuator, phpMyAdmin, wp-login…), or any secrets/backup/debug path returns 2xx · high when a secrets, backup or debug path returned 2xx with a body

Burst of 404 responses

≥20 404 responses served to one IP · medium at ≥100 responses

Administrator-equivalent IAM permissions granted

Successful Attach*Policy of AdministratorAccess / IAMFullAccess or of a policy allowing Action "*" on Resource "*"; Put*Policy, CreatePolicy or CreatePolicyVersion with such a document · high when an admin-equivalent policy was created but not attached in this log

IAM credentials or trust created for persistence

Successful CreateUser, CreateAccessKey, CreateLoginProfile, UpdateLoginProfile, UpdateAssumeRolePolicy, DeactivateMFADevice and similar · medium for CreateUser and for access keys a user creates for itself

IAM permissions changed

Successful Attach*Policy, Put*Policy, CreatePolicyVersion, SetDefaultPolicyVersion, AddUserToGroup or permission-boundary changes that are not admin-equivalent

Logging, detection or security controls disabled

StopLogging, DeleteTrail, UpdateTrail, PutEventSelectors, DeleteDetector, StopConfigurationRecorder, DeleteFlowLogs, DisableSecurityHub, DeleteAccountPasswordPolicy and similar calls · high for updates (UpdateTrail, PutEventSelectors, UpdateDetector…); medium when the attempt failed

Root account used

Any event whose userIdentity.type is Root (excluding AWS service events)

Console sign-in failures

≥5 failed ConsoleLogin events from one source IP (or for one user) within 24 h

Burst of AccessDenied errors

≥10 AccessDenied / UnauthorizedOperation errors for one principal within 60 min

Sign-in succeeded after repeated failures

A successful user.session.start from an IP that, in the previous 24 h, failed ≥5 times or for ≥2 different accounts, with failures making up ≥50% of its attempts · high when the source is a private address

Password spray

One IP fails primary authentication for ≥5 distinct accounts within 24 h

Brute force against one account

≥10 failed primary authentications for one account within 24 h

MFA push fatigue

≥3 push denials, challenge timeouts or failed MFA verifications for one user within 60 min

Administrator privileges granted

user.account.privilege.grant, group.privilege.grant, or a support impersonation grant/session

Sign-on security configuration changed

Changes to sign-on/MFA policies and rules, network zones, authenticators, identity providers, MFA factor resets and API token creation · high for deactivations and deletions, new identity providers and MFA authenticator removal

Okta ThreatInsight flagged a source

security.threat.detected or security.request.blocked events · medium when the request was only blocked

Account lockouts

user.account.lock events · medium when ≥3 accounts lock out

Impossible travel

Consecutive successful sign-ins by one account ≥500 km apart at an implied speed above 1,000 km/h

One account used from several countries

Successful sign-ins for one account from ≥3 countries within 24 h

Instructions aimed at AI log triage

A user agent, username, path or similar attacker-controlled field contains LLM instructions ("ignore previous instructions", "set severity to low", …)