Tag
Potential Account Takeover - Logon from New Source IP
2 rules 1 TTPThe rule identifies a user account that normally logs in with high volume from one source IP suddenly logging in from a different source IP, potentially indicating account takeover or use of stolen credentials from a new location.
Sentry SAML SSO Improper Authentication Allows User Identity Linking
2 rules 1 TTPA critical vulnerability (CVE-2026-42354) exists in Sentry's SAML SSO implementation that allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same Sentry instance, affecting self-hosted users with multiple organizations configured if a malicious user has permissions to modify SSO settings, while Sentry SaaS was patched in April and self-hosted users are advised to upgrade to version 26.4.1 or higher.
Jupyter Notebook Authentication Token Theft via CommandLinker XSS
2 rulesA stored Cross-Site Scripting (XSS) vulnerability in Jupyter Notebook versions 7.0.0 through 7.5.5 and JupyterLab versions up to 4.5.6 allows attackers to steal authentication tokens by tricking users into interacting with malicious notebook files, leading to complete account takeover via the Jupyter REST API.
Sentry SAML SSO Improper Authentication Vulnerability
2 rules 1 TTP 1 CVEA critical vulnerability in Sentry's SAML SSO implementation allows account takeover by exploiting improper authentication when multiple organizations are configured, affecting versions 21.12.0 to 26.2.0 and requiring a malicious SAML Identity Provider and knowledge of the victim's email address.
FastGPT NoSQL Injection Vulnerability in Password Change Endpoint
2 rules 2 TTPs 1 CVEFastGPT versions prior to 4.14.9.5 are vulnerable to NoSQL injection in the password change endpoint, allowing authenticated attackers to bypass password verification and perform account takeover.
Webkul Krayin CRM BOLA Vulnerability (CVE-2026-38529)
2 rules 1 TTP 1 CVECVE-2026-38529 is a Broken Object-Level Authorization (BOLA) vulnerability in Webkul Krayin CRM v2.2.x that allows authenticated attackers to reset user passwords and take over accounts.
ArthurFiorette steam-trader 2.1.1 Sensitive Information Exposure
2 rules 3 TTPsCVE-2026-5128 exposes sensitive Steam account data via the /users API endpoint and logs in ArthurFiorette steam-trader 2.1.1, allowing account takeover.
Potential Account Takeover via Mixed Logon Types
2 rules 1 TTPA Windows account, usually a service account, exhibiting a sudden shift in logon type patterns may indicate account compromise and lateral movement.
Budibase XSS Leads to Account Takeover via JWT Theft
2 rules 1 TTPThe `budibase:auth` cookie in Budibase is set without the `httpOnly` flag, enabling attackers with XSS to steal JWTs and gain persistent access to user accounts.