Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
2
Contributors
2
Categories
2
2
1
Platforms
2
Products / Services
2
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
This rule detects the creation of AWS API keys for a user by a different user. This activity is indicative of a backdoored user account being used to establish persistence within an AWS environment. It can also help identify unusual flows of AWS key creation within an organization.
This rule detects when the master password for an AWS RDS database instance is changed. This activity could be a precursor to data exfiltration or an attempt to gain unauthorized access to the database. The rule specifically looks for the 'ModifyDBInstance' event from 'rds.amazonaws.com' where the 'masterUserPassword' in 'pendingModifiedValues' is present, indicating a password change.