Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
98 detections
Filters
Last updated
All Time
Detection languages
45
19
10
8
6
Contributors
23
20
10
8
6
Categories
79
44
11
11
8
Platforms
46
36
15
10
10
Products / Services
30
28
20
10
6
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
2
IDS Classtypes
4
1
IDS Protocols
5
Detects enumeration of Entra ID applications and permissions via AzureHound or ROADrecon, identified by distinct user-agent strings or abnormal Graph API request volume — the same signal Organization B's custom alerts used to catch CISA's red team.
Detects anomalous discovery behavior in Azure where a principal performs multiple 'read' operations against both Container Registry and Role Assignments within a short timeframe. This pattern is consistent with an adversary attempting to map the cloud environment, identify accessible resources, and understand permission structures.
Detects anomalous activity where an identity performs a sequence of reconnaissance-related AWS API calls (e.g., listing roles, policies, or describing instances) followed shortly (within 10 minutes) by deployment actions like RunInstances or CreateCluster. This behavior is indicative of an attacker who has gained access to an identity and is surveying the environment before provisioning malicious infrastructure.
Detects rapid, multi-type API enumeration (GetCallerIdentity, ListBuckets, DescribeInstances) performed by an IAM principal or AssumedRole that has no historical record of performing these actions. This pattern is indicative of potential credential theft, specifically from compromised developer tooling such as malicious MCP configurations or automated agents like Amazon Q, Claude Code, Cursor, or Windsurf.
Detects enumeration of Entra ID (Azure AD) users, groups, devices, and service principals using the Microsoft Graph API, specifically when performed by tools like AzureHound or Roadtx. The detection focuses on activity originating from sign-ins that bypassed MFA, potentially leveraging a hidden CA policy scope exclusion (CVE-2025-0309). The rule identifies suspicious user agents and a high volume of requests to multiple Graph API enumeration endpoints.
Detects a multi-stage attack where an adversary reads local AWS credentials or configuration files (e.g., .aws/credentials, mcp.json) on a developer workstation and subsequently performs unauthorized AWS API calls from the same source IP. The rule correlates initial credential access on the endpoint with a sequence of AWS CloudTrail events starting with identity verification (GetCallerIdentity) followed by enumeration and potentially high-impact API calls (e.g., RunInstances, AssumeRole).
Detects execution of AWS STS commands to identify the caller's identity in conjunction with suspicious outbound POST requests. This pattern is commonly used by adversaries to verify compromised cloud credentials or enumerate permissions within an AWS environment.
This rule detects potentially suspicious AWS API activity by identifying IAM identities that perform high-privilege operations or use developer-oriented user agents (e.g., boto3, python-requests) from multiple distinct IP addresses within a one-hour window. It calculates a risk score based on the combination of source IP diversity, developer tool usage, and the presence of sensitive API calls such as CreateUser, CreateAccessKey, RunInstances, and AssumeRole.
Detects sign-in events where Conditional Access was not applied for Microsoft Graph access using low-privileged client IDs known to trigger hidden CA exclusions. Tokens issued with only single-factor authentication to Graph indicate exploitation of the hidden scope exclusion behavior introduced when any exclusion is added to an 'All resources' CA policy (CVE-2025-0309). Additionally, this rule identifies audit log events for Conditional Access policy modifications that add exclusions.
Detects the execution of AWS CLI commands by common scripting interpreters (Node.js or Python). This behavior is often indicative of automated cloud environment reconnaissance or credential testing using compromised access keys or instances.
Detects collection of service principals, app role assignments, delegated grants, and ownership data via Microsoft Graph API, which can identify privilege escalation paths. The rule specifically looks for a high volume of GET requests (35 or more within a 15-minute window) to URIs associated with enumerating service principals, app role assignments, oauth2 permission grants, and owned objects.
Detects the execution of AWS Security Token Service (STS) CLI commands (such as get-caller-identity) initiated by development-related processes like VS Code (Code.exe), Code Helper, or Node.js. This behavior may indicate an attacker leveraging developer environments to perform cloud infrastructure discovery or enumerate AWS permissions.
Detects the execution of cloud CLI tools (aws, curl) or shell interpreters (bash, sh, cmd, powershell) triggered by development-related processes like Node.js, VS Code, or Amazon Q. This pattern is indicative of potential command-and-control activity or credentials theft occurring via compromised developer environments.
Detects unauthenticated or anonymous access attempts to cloud storage buckets, specifically targeting Azure Blob Storage and AWS S3. The rule identifies access to publicly exposed buckets or those with anonymous access enabled, including specific bucket names associated with known OPSEC failures (pois43, w456w5, sentiwaw). This could indicate data exposure or reconnaissance by unauthorized actors.
Detects bulk AWS API calls for cloud infrastructure discovery
Detects enumeration of S3 bucket objects for cloud data discovery
Detects bulk AWS API calls for cloud infrastructure discovery
Detects enumeration of Docker containers and images
This rule detects HTTP requests to the Google Cloud Asset Inventory API, specifically targeting the '/assets' endpoint. This activity could indicate an attempt to enumerate cloud resources within a Google Cloud Platform environment.
This rule detects attempts to enumerate AWS S3 buckets by making HTTP requests to s3.amazonaws.com with the '?list-type=2' parameter in the URI. This type of request is commonly used to list the contents of an S3 bucket.
This rule detects attempts to enumerate AWS EC2 instances via the DescribeInstances API call. It specifically looks for HTTP traffic destined for 'ec2.amazonaws.com' with 'DescribeInstances' in the URI, indicating a potential reconnaissance activity against AWS EC2 infrastructure.
Page 3 of 5