Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,832 detections
Filters
Last updated
All Time
Detection languages
1,375
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,443
11,831
5,875
5,151
4,864
2,832
Platforms
1,449
916
693
670
264
Products / Services
994
701
613
469
216
MITRE Techniques
1,240
912
484
482
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detects the use of iam:CreatePolicyVersion and iam:SetDefaultPolicyVersion API calls, which are critical IAM actions that can be abused to escalate privileges by defining a new version of an IAM policy with excessive permissions and setting it as the default.
Detects rapid, large-scale deployment of high-vCPU/GPU compute instances, potentially indicating resource hijacking for cryptomining. The rule correlates high-compute instance launches with preceding AWS service quota increases, identifying potential malicious activity within an AWS environment.
Detects administrative actions intended to disable, modify, or suppress logging and alerting capabilities within AWS and Azure, specifically targeting services like Amazon GuardDuty, AWS Security Hub, AWS Config, and Microsoft Defender for Cloud. Such actions are frequently observed as a precursor to unauthorized activity to hide malicious actions from detection systems.
Detects successful AWS STS AssumeRole, AssumeRoleWithSAML, or AssumeRoleWithWebIdentity calls originating from an AWS account ID not included in the 'trusted_aws_accounts' lookup. The rule further enriches events with geolocation and ASN data to flag potential cross-account activity from high-risk or unexpected regions.
Detects anomalous cloud authentication activity where an OIDC provider is created or its thumbprint is updated, followed by an 'AssumeRoleWithWebIdentity' call originating from a GitHub Actions subject claim that does not match authorized repository or branch patterns. This often indicates an adversary abusing OIDC trust relationships to gain unauthorized access to high-privileged roles, frequently linked to subsequent IAM policy modifications like 'setIamPolicy' in GCP to grant persistent 'owner' access.
Detects potential ransomware activity in AWS by identifying high volumes of S3 object encryption (using SSE-C or KMS) followed by the disabling or scheduled deletion of the associated KMS key material. This behavior aims to render data inaccessible to legitimate users while ensuring recovery is inhibited by destroying the cryptographic keys required for decryption.
Detects the creation of an AWS CloudShell environment followed by a high volume of file transfer activity (PutFile, GetFile, or PutObject) by the same user within a short time window. This pattern is indicative of potential initial access or abuse of CloudShell for tool staging or unauthorized data exfiltration.
Detects the attachment or creation of IAM policies that grant administrative access (via 'AdministratorAccess' policy name) or full wildcard permissions ('Action': '*', 'Resource': '*') to users, roles, or groups. This activity is a common indicator of privilege escalation following a cloud identity compromise, frequently observed in campaigns by threat actors such as Scattered Spider (UNC3944).
Detects unauthorized attempts to disable, delete, or weaken AWS CloudTrail logging and supporting infrastructure. This includes stopping log delivery, deleting trails, reducing scope via event selectors, removing VPC flow logs or CloudWatch log groups, and unauthorized administrative actions against the S3 bucket designated for CloudTrail logs.
Detects anomalous GCP IAM Service Account Credential API calls where a principal impersonates multiple distinct service accounts within a short time window. This behavior often indicates a credential delegation chain or a multi-stage privilege escalation attempt within a GCP environment.
Detects unauthorized attempts to disable, delete, or weaken AWS CloudTrail logging and supporting infrastructure. This includes stopping log delivery, deleting trails, reducing scope via event selectors, removing VPC flow logs or CloudWatch log groups, and unauthorized administrative actions against the S3 bucket designated for CloudTrail logs.
Detects the deployment of virtual machines with public IP addresses (in Azure) or compute instances with external IP addresses (in GCP) by a single principal within a 15-minute window. This behavior is indicative of a newly-privileged identity or an compromised account establishing externally-accessible infrastructure for further malicious activity.
Detects potential abuse of Cloud Shell to persist access in cloud environments. For GCP, it monitors the injection of SSH keys into instance or project metadata from a Cloud Shell session. For Azure, it detects a pattern involving Cloud Shell storage provisioning followed by a subsequent VM run-command or SSH public key update, indicating potential unauthorized management of virtual machines.
Detects the rapid, bulk launch of GPU-optimized or compute-intensive EC2 instances via API calls such as RunInstances, CreateFleet, or RequestSpotFleet within a short time window. This behavior is often indicative of cloud resource hijacking or cryptojacking, where compromised credentials are used to spin up expensive compute resources for illicit mining or intensive processing.
Detects potential privilege escalation in AWS where a user performs an iam:PassRole action to attach a highly privileged role (e.g., containing 'admin' or 'poweruser' in the name) to a newly created resource (Lambda, EC2 instance, or CloudFormation stack) within a short timeframe. This behavior is a known technique to gain elevated permissions by executing code within the context of a higher-privilege identity.
Detects modifications to AWS EBS or RDS snapshot attributes to grant access to unauthorized or external AWS accounts, or the copying of snapshots to unauthorized accounts, which are common techniques for data exfiltration from cloud environments.
Detects various administrative actions in AWS that result in the disabling, deletion, or suppression of security monitoring services and configurations, including CloudTrail, Security Hub, and AWS Config. This behavior is indicative of an adversary attempting to evade detection by blinding security teams.
Detects anomalous or suspicious creation of AWS IAM access keys, particularly those targeting highly privileged accounts (e.g., 'root') or involving cross-user key generation by non-administrative entities. This behavior is indicative of potential account takeover, persistence establishment, or privilege escalation within the AWS environment.
Detects attempts to disable, degrade, or bypass cloud-native security monitoring services in GCP and Azure. This includes disabling GCP Security Command Center, creating broad mute configurations for security findings, downgrading Azure Defender for Cloud pricing tiers, or deleting Azure security automation workflows. These actions are common indicators of defense evasion during an incident.
Detects modifications to AWS S3 bucket permissions or public access block settings that result in publicly accessible buckets. The rule specifically monitors CloudTrail events such as PutBucketAcl, PutBucketPolicy, and PutPublicAccessBlock for configurations that permit AllUsers/AuthenticatedUsers access, overly permissive bucket policies with wildcard principals, or the deactivation of all four block-public-access settings.
Detects potential backdoored persistence in AWS Lambda functions. The rule monitors for two patterns: 1) A Lambda function creation followed by granting cross-account 'lambda:InvokeFunction' permissions to an untrusted or wildcard principal. 2) A privilege escalation event (such as attaching policies) followed by a 'lambda:UpdateFunctionCode' operation on the same function by the same principal, which may indicate an attempt to inject malicious code into a serverless function.
Page 21 of 135