Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
960 detections
Filters
Last updated
All Time
Detection languages
215
211
197
168
63
Contributors
283
142
113
112
85
Categories
670
218
168
112
95
Platforms
39,936
7,266
6,537
3,866
3,647
960
Products / Services
713
68
64
59
59
MITRE Techniques
310
305
146
136
134
CVEs
5
3
3
2
1
IDS Classtypes
13
11
11
9
8
IDS Protocols
62
1
Identifies the Python script explicitly reading developer secrets including AWS credentials, SSH private keys, and Kubernetes configuration files.
Detects processes attempting to query the Cloud Instance Metadata Service (IMDS) endpoint (169.254.169.254) that are not recognized as legitimate cloud agent software (such as AWS, Azure, or Google cloud agents). This behavior is often indicative of SSRF or unauthorized discovery attempts by an adversary on a compromised cloud instance.
Detects processes attempting to query the Cloud Instance Metadata Service (IMDS) endpoint (169.254.169.254) that are not recognized as legitimate cloud agent software (such as AWS, Azure, or Google cloud agents). This behavior is often indicative of SSRF or unauthorized discovery attempts by an adversary on a compromised cloud instance.
Detects unauthorized or non-standard processes attempting to create, modify, or access sensitive cloud configuration and credential files, such as AWS credentials, Azure CLI token caches, or GCP application default credentials. This behavior is indicative of potential credential theft or unauthorized access to cloud environment tokens.
Detects enumeration of cloud storage objects for data discovery
Detects reversion of cloud instances to snapshots to remove evidence
Detects DNS resolution to attacker-controlled AWS S3 buckets masquerading as Outlook/OneDrive service pages used by UNC6692 for phishing delivery, SNOWBELT C2, and credential exfiltration. The rule specifically looks for DNS queries to S3 domains with patterns indicative of spoofed Outlook/OneDrive service pages or specific known malicious S3 bucket names.
This rule detects suspicious activities involving AWS CLI or curl commands spawned from IDE-related processes (amazonq-language-server, Code.exe). It monitors for command patterns indicating credential discovery (aws sts get-caller-identity) or data exfiltration (curl POST requests), and correlates these with unusual CloudTrail GetCallerIdentity events occurring from non-AWS source IP addresses.
Correlates CI/CD runners utilizing AWS credentials to execute secretsmanager:ListSecrets or GetSecretValue outside normal parameters. This rule detects processes named 'aws' executing commands related to AWS SecretsManager, specifically 'ListSecrets' or 'GetSecretValue'.
Detects the deletion of a storage bucket immediately followed by the creation of a new bucket with the same name across different cloud providers (GCP, AWS S3, Azure). This rule specifically flags scenarios where the deleting actor or project differs from the creating actor or project, indicating a potential cross-account hijack or data exfiltration attempt.
Detects a potential S3 bucket hijacking attempt where an S3 bucket is deleted and shortly after, an AWS Firehose delivery stream is created or updated to target a bucket with the same name, but under a different AWS account. This could indicate an adversary attempting to exfiltrate data by redirecting data intended for the original bucket to their own controlled bucket.
Detects instances where common web application processes (such as Flask, Django, Gunicorn) execute system utilities (curl, wget, etc.) to query the cloud metadata service URL (169.254.169.254) or domain names associated with instance metadata. This behavior is indicative of potential SSRF exploitation to retrieve cloud environment secrets or instance identity credentials.
This rule detects suspicious activities related to AWS S3 buckets that could indicate a bucket hijacking attempt or unauthorized replication to an external account. Specifically, it looks for two scenarios: 1) an S3 bucket being deleted and then recreated by a different AWS account within a one-hour window, suggesting a namespace hijacking, or 2) an S3 bucket being deleted while a PutBucketReplication event references an external AWS account, indicating an attempt to exfiltrate data or maintain access through replication.
Detects a sequence of events where an Amazon S3 bucket is deleted, followed within one hour by the creation of an Amazon Data Firehose delivery stream or an update to a destination using the same bucket name. This pattern indicates a potential bucket name hijacking attempt, where an attacker recreates the deleted bucket to intercept or redirect data streams processed by Firehose.
Detects the execution of cloud CLI tools (aws, az, gsutil) using commands designed for bulk or recursive deletion of data from cloud object storage (S3, Azure Blob, GCS). This activity is commonly associated with destructive attacks, ransomware, or unauthorized data removal.
Detects the execution of cloud CLI tools (aws, az, gsutil) using commands designed for bulk or recursive deletion of data from cloud object storage (S3, Azure Blob, GCS). This activity is commonly associated with destructive attacks, ransomware, or unauthorized data removal.
Detects unauthorized or non-standard processes attempting to create, modify, or access sensitive cloud configuration and credential files, such as AWS credentials, Azure CLI token caches, or GCP application default credentials. This behavior is indicative of potential credential theft or unauthorized access to cloud environment tokens.
This rule detects potential unauthorized access to AWS credentials by monitoring process creation events involving the 'get-caller-identity' command. It identifies scenarios where AWS access key environment variables are accessed or manipulated, and monitors common shell or node processes executing commands to query AWS identity information, which may indicate credential exfiltration or reconnaissance by an attacker.
Detects anomalous authentication patterns where a single source IP address exhibits multiple failed login attempts followed by at least one successful login within a 10-minute time window, indicative of credential stuffing or password spraying.
This rule detects the use of common cloud command-line interfaces (Azure CLI, Azure PowerShell, and AWS CLI) to perform resource discovery, specifically identifying commands used to list virtual machines or describe EC2 instances. Such activity, if performed by an unexpected user or on an endpoint where cloud management tools are not typically installed, may indicate reconnaissance by an adversary.
Detects Python accessing AWS, Azure, Google Cloud, Kubernetes, Docker, Terraform, or Vault credential stores. This rule specifically looks for Python processes executing commands that contain keywords associated with cloud CLI credential files or configuration paths.
Page 22 of 46