Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
30 detections
Filters
Last updated
All Time
Detection languages
12
8
6
2
1
Contributors
8
7
6
3
1
Categories
20
17
14
5
1
Platforms
16
9
2
2
1
Products / Services
16
9
2
2
2
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
IDS Classtypes
1
IDS Protocols
1
The following analytic detects the deletion of AWS Network Access Control Lists (ACLs). It leverages AWS CloudTrail logs to identify events where a user deletes a network ACL entry. This activity is significant because deleting a network ACL can remove critical access restrictions, potentially allowing unauthorized access to cloud instances. If confirmed malicious, this action could enable attackers to bypass network security controls, leading to unauthorized access, data exfiltration, or further compromise of the cloud environment.
The following analytic detects the creation of AWS Network Access Control Lists (ACLs) with all ports open to a specified CIDR. It leverages AWS CloudTrail events, specifically monitoring for `CreateNetworkAclEntry` or `ReplaceNetworkAclEntry` actions with rules allowing all traffic. This activity is significant because it can expose the network to unauthorized access, increasing the risk of data breaches and other malicious activities. If confirmed malicious, an attacker could exploit this misconfiguration to gain unrestricted access to the network, potentially leading to data exfiltration, service disruption, or further compromise of the AWS environment.
The following analytic detects the deletion of AWS Network Access Control Lists (ACLs). It leverages AWS CloudTrail logs to identify events where a user deletes a network ACL entry. This activity is significant because deleting a network ACL can remove critical access restrictions, potentially allowing unauthorized access to cloud instances. If confirmed malicious, this action could enable attackers to bypass network security controls, leading to unauthorized access, data exfiltration, or further compromise of the cloud environment.
Identifies when a domain is added to the list of trusted domains in Google Workspace. An adversary may attempt to manipulate sharing settings for trusted domains to gain unauthorized access to sensitive files and folders within an organization.
This rule identifies when an Azure Firewall resource is created, modified, or deleted within an Azure subscription. This activity is captured through Azure Activity Logs, specifically looking for 'MICROSOFT.NETWORK/AZUREFIREWALLS/WRITE' (for creation/modification) and 'MICROSOFT.NETWORK/AZUREFIREWALLS/DELETE' operations. Such changes can indicate legitimate administrative actions or potentially malicious attempts to alter network defenses.
This rule identifies when an Azure Key Vault is modified or deleted. Key Vaults store sensitive information such as cryptographic keys, certificates, and secrets. Unauthorized modification or deletion of a Key Vault could indicate an attacker attempting to disrupt services, remove evidence, or gain access to sensitive credentials. The rule specifically looks for operations related to writing, deleting, deploying, or modifying access policies of Key Vaults.
Identifies when an Azure Network Firewall Policy is modified or deleted. This could indicate an attempt to bypass security controls or disrupt network segmentation.
Detects when a firewall rule is modified, deleted, or inserted in Google Cloud Platform (GCP). This activity can indicate an adversary attempting to impair defenses or establish persistence by altering network access controls.
This rule identifies when Azure Firewall Rule Collections (Application, NAT, and Network) are either modified or deleted. This activity can indicate an attempt to bypass network controls, potentially allowing unauthorized access or data exfiltration. Monitoring these operations is crucial for maintaining network security posture in Azure environments.
Page 2 of 2