Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,004 detections
Filters
Last updated
All Time
Detection languages
1,442
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,443
11,831
5,875
5,151
4,864
3,004
Platforms
1,199
673
623
512
218
Products / Services
880
726
311
257
229
MITRE Techniques
1,661
1,109
905
468
464
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
This rule detects administrative changes to Conditional Access (CA) policies in Entra ID (Azure AD), specifically monitoring for the disabling of policies, transitioning them to report-only mode, or the removal of critical security grant controls such as MFA or Compliant Device requirements. It also alerts on the outright deletion of any CA policy, which could indicate an adversary attempting to bypass security controls or maintain persistent access.
Detects anomalous cross-account AssumeRole activities, including chained role assumptions, which are often used by cloud-native intrusion sets to launder access, evade single-account logging detection, and move laterally across AWS environments. The rule identifies AssumeRole events targeting non-allowlisted accounts or sequences where credentials are immediately used to perform further cross-account assumptions.
Detects modifications to AWS IAM trust relationships, specifically the creation or update of SAML providers, OIDC providers, or the update of role trust policies containing wildcard principals. These actions are indicative of an attacker attempting to establish a durable, credential-less persistence mechanism via federated identity manipulation.
Detects the creation or modification of credentials (access keys or login profiles) for the AWS root account or identities explicitly named to imply high-privilege administrative access. This is a high-fidelity indicator of persistence or unauthorized privilege escalation within an AWS environment.
Detects the creation of an AWS IAM access key (CreateAccessKey) for the root account or identities with administrative naming conventions. This activity can indicate persistence establishment by an attacker who has gained high-privileged access, as new access keys provide a durable way to maintain programmatic control that bypasses standard session-based security controls.
Detects unauthorized attempts to stop CloudTrail logging or delete existing CloudTrail configurations within an AWS environment. Disabling logging is a significant indicator of defense evasion, often used by attackers to mask subsequent malicious activities such as data exfiltration, privilege escalation, or resource abuse.
Detects the creation of a new AWS IAM role with a trust policy that permits access from an external or wildcard principal, which is often used as a persistence mechanism to allow unauthorized cross-account access. The rule also triggers if an AdministratorAccess policy is attached to a newly created role, as these actions are commonly chained in cloud intrusions.
Detects the attachment of the 'AdministratorAccess' managed policy or custom policies with wildcard actions and resources to AWS IAM users, roles, or groups. This activity is a critical indicator of privilege escalation, often serving as the final step in gaining full control of an AWS account by an adversary.
Detects the attachment of the 'AdministratorAccess' managed policy or custom policies with wildcard actions and resources to AWS IAM users, roles, or groups. This activity is a critical indicator of privilege escalation, often serving as the final step in gaining full control of an AWS account by an adversary.
This rule detects the use of browser-based cloud shells (AWS CloudShell, Azure Cloud Shell) as an entry point for post-exploitation activities, specifically tracking when these sessions are followed by object storage operations (S3 PutObject/GetObject or equivalent Azure Blob operations) within the same session context. This pattern is indicative of attackers using ephemeral cloud shells to stage stolen data or download offensive tooling, thereby bypassing host-based EDR monitoring.
Detects the attachment of the 'AdministratorAccess' managed policy or custom policies with wildcard actions and resources to AWS IAM users, roles, or groups. This activity is a critical indicator of privilege escalation, often serving as the final step in gaining full control of an AWS account by an adversary.
This rule detects the use of browser-based cloud shells (AWS CloudShell, Azure Cloud Shell) as an entry point for post-exploitation activities, specifically tracking when these sessions are followed by object storage operations (S3 PutObject/GetObject or equivalent Azure Blob operations) within the same session context. This pattern is indicative of attackers using ephemeral cloud shells to stage stolen data or download offensive tooling, thereby bypassing host-based EDR monitoring.
This rule detects the launch of an AWS EC2 instance that is configured with an IAM instance profile containing administrative keywords (e.g., AdministratorAccess, FullAccess) or a wildcard (*). Attackers can abuse this configuration after gaining initial access to the console or API to attach an over-privileged profile to a new instance, then pivot to the instance metadata service (IMDS) to extract these administrative credentials for persistent, broadly-scoped access.
Detects the creation of an AWS IAM access key followed immediately by the use of that key from a new or anomalous geolocation, which is a strong indicator of credential theft or unauthorized key generation for persistence.
Detects rapid, large-scale deployment of high-vCPU/GPU compute instances, potentially indicating resource hijacking for cryptomining. The rule correlates high-compute instance launches with preceding AWS service quota increases, identifying potential malicious activity within an AWS environment.
Detects successful AWS STS AssumeRole, AssumeRoleWithSAML, or AssumeRoleWithWebIdentity calls originating from an AWS account ID not included in the 'trusted_aws_accounts' lookup. The rule further enriches events with geolocation and ASN data to flag potential cross-account activity from high-risk or unexpected regions.
Detects anomalous cloud authentication activity where an OIDC provider is created or its thumbprint is updated, followed by an 'AssumeRoleWithWebIdentity' call originating from a GitHub Actions subject claim that does not match authorized repository or branch patterns. This often indicates an adversary abusing OIDC trust relationships to gain unauthorized access to high-privileged roles, frequently linked to subsequent IAM policy modifications like 'setIamPolicy' in GCP to grant persistent 'owner' access.
Detects the attachment or creation of IAM policies that grant administrative access (via 'AdministratorAccess' policy name) or full wildcard permissions ('Action': '*', 'Resource': '*') to users, roles, or groups. This activity is a common indicator of privilege escalation following a cloud identity compromise, frequently observed in campaigns by threat actors such as Scattered Spider (UNC3944).
Detects potential abuse of Cloud Shell to persist access in cloud environments. For GCP, it monitors the injection of SSH keys into instance or project metadata from a Cloud Shell session. For Azure, it detects a pattern involving Cloud Shell storage provisioning followed by a subsequent VM run-command or SSH public key update, indicating potential unauthorized management of virtual machines.
Detects the rapid, bulk launch of GPU-optimized or compute-intensive EC2 instances via API calls such as RunInstances, CreateFleet, or RequestSpotFleet within a short time window. This behavior is often indicative of cloud resource hijacking or cryptojacking, where compromised credentials are used to spin up expensive compute resources for illicit mining or intensive processing.
Detects modifications to AWS EBS or RDS snapshot attributes to grant access to unauthorized or external AWS accounts, or the copying of snapshots to unauthorized accounts, which are common techniques for data exfiltration from cloud environments.
Page 19 of 144