Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,832 detections
Filters
Last updated
All Time
Detection languages
1,375
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,443
11,831
5,875
5,151
4,864
2,832
Platforms
1,449
916
693
670
264
Products / Services
994
701
613
469
216
MITRE Techniques
1,240
912
484
482
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detect when GCP Compute Image is opened to public by adding allAuthenticatedUsers to the access policy.
Detect when Google Cloud Storage buckets are opened to public by adding allUsers or allAuthenticatedUsers to the access policy.
Detects API Calls from AWS accounts that are not part of the organization.
Detects when AWS API Gateway keys are accessed.
Detects when a CloudWatch log group is deleted.
Detects when a GuardDuty Detector's publishing destination has been deleted which will prevent the exporting of findings.
Detects when a GuardDuty Detector's trusted or threat intel IP lists are deleted or disabled.
Detects when an Amazon RDS Snapshot is shared publicly.
Detect when GCP BigQuery datasets are opened to public by adding allUsers or allAuthenticatedUsers to the access policy.
Detect when GCP Cloud Audit logs are exempted for principals in all services at project or organization level. Audit logging helps organizations maintain security and minimize risk.
Detect when free Google Email addressess are added to IAM Policy such as gmail.com, googlemail.com or googlegroups.com.
AWS Backup Plan Deleted
YARA-L
Detects when AWS Backup Plan is deleted.
Detects when CloudTrail logging is updated, stopped or deleted.
Detects a successful attempt to retrieve the encrypted Administrator password for a Windows EC2 instance.
Detects excessive AccessDenied events within an hour timeframe from an IAM User
Detect when the AWS managed policy AWSCompromisedKeyQuarantine has been attached to a user, role, or group. It is applied by the AWS team in the event that the credentials of an IAM user has been compromised or publicly exposed.
Detect when a KMS (Key Management Service) key is disabled or scheduled for deletion.
Detects create, update or delete events of a SAML provider in AWS.
Detect when the Amazon Simple Email Service (SES) has been modified where an attacker can modify Amazon SES service to propagate phishing emails campaigns.
Detect when admin privileged roles such as Owner or Editor are added to a Service Account.
Detect a user downloads GCP BigQuery results from multiple tables which might indicate data exfiltration activity.
Page 128 of 135