title: Suspicious Admin Login
id: AB-DR-001
status: test
description: Detects admin login containing 'admin' in username
logsource: { product: auth }
detection:
  selection: { username|contains: admin }
  condition: selection
level: medium