Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,832 detections
Filters
Last updated
All Time
Detection languages
1,375
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,453
11,837
5,876
5,154
4,865
2,832
Platforms
1,449
916
693
670
264
Products / Services
994
701
613
469
216
MITRE Techniques
1,240
912
484
482
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detects modifications to AWS S3 bucket Access Control Lists (ACLs) using the 'PutBucketAcl' API call that grant public read or write permissions. This could indicate an attempt to make sensitive data stored in S3 publicly accessible, potentially leading to data exfiltration.
Detects the use of AWS CloudShell to execute commands that download or install external files (e.g., using curl, wget, pip, or git), excluding those originating from known approved sources such as AWS-owned domains or standard package registries. This behavior may indicate an adversary attempting to download offensive tooling or backdoors into the cloud environment.
Detects 'PutBucketPolicy' API calls in AWS CloudTrail where the policy is modified to grant 'Allow' access to a wildcard ('*') or anonymous principal, without including restrictive conditional requirements such as VPC endpoints or organizational ID constraints. This behavior is a common precursor to data exfiltration from misconfigured S3 buckets.
Detects modifications to AWS EC2 snapshot or AMI attributes that grant cross-account permissions, including making them publicly accessible. This activity may indicate an attempt to exfiltrate volume data, such as credentials, configuration, or database contents, to an external AWS account.
Detects unauthorized attempts to disable, suppress, or modify security monitoring services in AWS, including GuardDuty, Security Hub, and AWS Config. This rule monitors for API calls that effectively reduce cloud visibility or detection capabilities, explicitly excluding actions performed by authorized security-engineering roles.
Detects the creation of recurring EventBridge rules or EventBridge Scheduler schedules configured with cron or rate expressions that trigger Lambda functions or SSM automation documents. This activity is a common method for cloud-native persistence, allowing for durable, recurring execution of malicious code that persists across credential rotations or resource deletions, provided the actor is not a recognized platform-engineering entity.
Detects a rapid burst of read-only IAM and STS API enumeration calls originating from a single source IP address within a one-minute window. This behavior is indicative of automated reconnaissance tools (e.g., enumerate-iam, Pacu) used in the early stages of a cloud attack to identify permissions and potential targets for privilege escalation.
Detects high-volume mailbox item access (MailItemsAccessed) within 15-minute intervals, correlated with risky Entra ID sign-in events within a 60-minute window. This behavior is indicative of automated mail reconnaissance or data exfiltration following potential cloud account compromise.
Detects the granting of high-risk OAuth application scopes (e.g., Mail.Read, offline_access) within two hours of a risky sign-in event for the same user. This pattern is indicative of attackers establishing persistence and maintaining access to sensitive data (such as emails or files) even after potential credential resets.
Detects rapid mass-cloning or downloading of private GitHub repositories shortly after an OAuth token authorization, originating from IP addresses or countries not previously associated with the user account. This behavior is indicative of unauthorized bulk data extraction using compromised credentials, consistent with threat actor activity (e.g., TeamPCP/UNC6780).
Detects anomalous AWS activity combining bulk secret retrieval from AWS Secrets Manager using the BatchGetSecretValue API with subsequent authentication failures or validation errors in AWS STS. This behavior is indicative of automated credential harvesting pipelines or agentic frameworks rapidly enumerating and testing stolen credentials.
Detects AWS CloudTrail and Azure Active Directory (Entra ID) privilege-escalation actions (e.g., attaching policies, creating access keys, adding roles) performed by principals from rare source IPs or associated with low-frequency administrative actions, indicating potentially compromised or unauthorized account activity.
Detects OAuth token requests associated with the 'PDF Identity Verifier' application or specific client IDs, often used by malicious browser extensions or phishing applications to exfiltrate sensitive Google account data, specifically Gmail and user profile information.
This rule detects high-risk AWS API calls that are commonly associated with privilege escalation and persistence. It monitors for the creation of overly permissive IAM policies (wildcard permissions), the creation of new access keys for existing users, and suspicious AssumeRole operations.
This rule detects potential illicit consent grants to OAuth applications within Azure AD. It identifies applications requesting high-risk scopes (such as Mail.Read, Files.ReadWrite.All, etc.) that are not verified by a publisher, are granted by non-admin users, and subsequently exhibit high volumes of graph API calls (suggestive of unauthorized data access or exfiltration).
Detects the granting of OAuth application permissions or app role assignments in Azure AD/Entra ID that include high-privilege scopes such as Mail.Read, Directory.ReadWrite.All, or offline_access. This behavior is characteristic of consent phishing attacks, where adversaries trick users into granting permissions to a malicious application to maintain persistent access to resources like email or tenant directories.
Detects potential AWS IAM privilege escalation attempts by identifying suspicious modifications to IAM policies, roles, or trust relationships, as well as unauthorized role assumption events. This rule monitors for activities such as attaching high-privilege policies (e.g., AdministratorAccess), creating new policy versions, and modifying trust policies to allow unexpected principals, which are common indicators of post-compromise activity designed to expand access within an AWS environment.
Detects instances where a user grants consent to an unverified OAuth application with high-privilege scopes (e.g., Mail.Read, Directory.Read.All), followed by an authentication event using that same application ID from a different IP address within 24 hours. This behavior is indicative of potential consent phishing or OAuth token abuse, where an adversary harvests tokens to maintain persistent, remote access to email or directory services.
Detects a sequence of potentially malicious local command execution (via PowerShell, cmd, or mshta) that mirrors the 'ClickFix' social engineering pattern, followed by an OAuth application consent grant or device-code authorization by the same user within a short timeframe. This behavior is indicative of an adversary attempting to bypass MFA by tricking a user into authorizing a malicious application after establishing local execution on their endpoint.
Detects the creation or exposure of public repositories, releases, or gists under a personal GitHub account that utilize naming conventions associated with the 'PixelLeak' workaround. This technique allows adversaries to make previously private screenshots, recordings, or internal assets publicly accessible by hosting them in public personal repositories or releases.
Detects the creation or exposure of public repositories, releases, or gists under a personal GitHub account that utilize naming conventions associated with the 'PixelLeak' workaround. This technique allows adversaries to make previously private screenshots, recordings, or internal assets publicly accessible by hosting them in public personal repositories or releases.
Page 27 of 135