Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
461 detections
Filters
Last updated
All Time
Detection languages
134
111
68
41
32
Contributors
136
63
56
49
29
Categories
264
153
62
60
59
Platforms
39,931
7,261
6,535
3,864
3,642
461
Products / Services
260
63
57
52
51
MITRE Techniques
148
103
61
58
58
CVEs
3
2
2
1
1
IDS Classtypes
7
5
5
4
3
IDS Protocols
27
Detects modification of cloud compute infrastructure to evade detection or remove evidence
This rule detects direct SSH connections to cloud virtual machines (VMs) via a serial console interface. It specifically looks for HTTP traffic where the host header contains 'compute.googleapis.com' or 'cloudshell.googleapis.com' and the URI contains 'serialPort'. This indicates an attempt to establish an SSH session through the cloud provider's serial console service, which can be used for administrative access or lateral movement within a cloud environment.
Detects serverless function deployments used as C2 infrastructure
This rule detects HTTP POST requests to the Google Cloud Platform (GCP) Compute Engine API (compute.googleapis.com). It specifically looks for a high volume of these requests (20 within 10 seconds from the same source IP), which could indicate automated activity or potential command execution attempts within GCP. The rule is designed to identify suspicious interactions with the GCP API that might be related to execution tactics.
This rule detects HTTP requests to the Google Cloud Asset Inventory API, specifically targeting the '/assets' endpoint. This activity could indicate an attempt to enumerate cloud resources within a Google Cloud Platform environment.
This rule detects attempts to enumerate objects within a Google Cloud Storage (GCS) bucket. It triggers when HTTP requests are made to 'storage.googleapis.com' with a URI containing '/b/', indicating an attempt to access or list buckets or their contents. The thresholding mechanism (10 events within 30 seconds from the same source IP) aims to identify rapid, potentially automated, enumeration activities.
This rule detects attempts to access secrets stored in Google Cloud Platform (GCP) Secret Manager via its API. It specifically looks for HTTP traffic directed to 'secretmanager.googleapis.com' with a URI path containing '/versions/' and ':access', indicating an attempt to access a specific secret version.
This rule detects a high volume of HTTP GET requests to storage.googleapis.com, indicating a potential bulk download of objects from Google Cloud Storage. The threshold is set to 50 requests within 60 seconds from a single source IP address.
This rule detects HTTP POST requests to cloud compute infrastructure management endpoints, specifically Amazon EC2, Google Cloud Compute, and Azure Management. The rule is triggered if 20 such requests are observed from a single source IP within 60 seconds, indicating potential automated activity to modify cloud infrastructure for evasion purposes.
This rule detects HTTP requests where the 'Host' header matches patterns commonly associated with serverless function domains, specifically AWS Lambda URLs, Azure Websites, and Google Cloud Functions. The rule is designed to identify potential command and control (C2) infrastructure utilizing serverless platforms. It triggers an alert if 10 such requests are observed from a single source IP within a 60-second window.
This rule detects large HTTP PUT requests (over 50KB) directed towards common cloud storage services (Amazon S3, Azure Blob Storage, Google Cloud Storage). This activity could indicate data exfiltration to an external cloud account.
This rule detects attempts to stage large amounts of data (over 65KB) to common cloud storage services (Amazon S3, Azure Blob Storage, Google Cloud Storage) via HTTP PUT requests. This activity is indicative of data being prepared for exfiltration.
This rule detects when a user performs a security investigation query within Google Workspace using the Security Investigation Tool. It extracts the user's UPN, the data source being investigated, and the query itself. This can help identify potential insider threat activity, unauthorized investigations, or unusual administrative behavior.
This rule detects HTTP POST requests to 'cloudfunctions.net', indicating a Google Cloud Function is being triggered for execution. The rule uses a threshold to alert only if 20 such requests are observed from the same source within 60 seconds, aiming to reduce noise from legitimate, infrequent triggers.
Detects when OAuth applications are added to trusted lists or granted Context-Aware Access (CAA) exemptions within Google Workspace. This activity bypasses user consent screens and CAA policies, potentially allowing malicious applications to gain unauthorized access. The rule also tracks permission escalation for existing applications via 'CHANGE_APP_ACCESS' events.
This rule detects attempts to upload executable files (specifically Windows MZ executables) to common cloud storage services like Amazon S3, Google Cloud Storage, and Azure Blob Storage. It looks for HTTP PUT requests containing the 'MZ' magic bytes at the beginning of the file data, indicating a Windows executable, with a file size greater than 100KB, directed towards known cloud storage domains.
This rule detects the launch of a GPU instance in Google Cloud Platform (GCP) by monitoring HTTP traffic. Specifically, it looks for HTTP requests to 'compute.googleapis.com' with the URI containing '/instances' and the client body containing 'acceleratorType' (case-insensitive). This combination suggests an attempt to provision a GPU-enabled virtual machine, which could be indicative of resource hijacking for purposes like cryptocurrency mining or other compute-intensive malicious activities.
Detects access or creation of files within Google Drive that have credential-related names, indicating potential credential harvesting attempts or unauthorized access to sensitive data. The rule specifically looks for file events such as 'view', 'edit', 'create', or 'access_url' on files whose titles contain keywords commonly associated with credentials (e.g., password, secret, key, token, etc.).
This rule detects HTTP POST requests to the GCP OS Login API endpoint 'oslogin.googleapis.com'. Such requests could indicate an attempt to execute commands on a Google Cloud instance using the OS Login feature, which is a common method for managing SSH access to instances.
This rule detects potential cloud API access using a stolen token by monitoring HTTP requests to AWS S3, Azure management, or Google APIs that contain an 'Authorization: Bearer' header. A threshold of 50 such requests within 10 seconds from the same source IP triggers the alert, indicating a possible brute-force or high-volume access attempt with a compromised token.
This rule detects HTTP POST requests to common cloud console login pages (AWS, Microsoft Azure, Google Cloud) that originate from a suspicious IP range. The rule uses a threshold of 5 attempts within 30 seconds from the same source IP to trigger an alert, indicating potential brute-force or credential stuffing attacks against cloud accounts.
Page 15 of 22