Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
960 detections
Filters
Last updated
All Time
Detection languages
215
211
197
168
63
Contributors
283
142
113
112
85
Categories
670
218
168
112
95
Platforms
39,936
7,266
6,537
3,866
3,647
960
Products / Services
713
68
64
59
59
MITRE Techniques
310
305
146
136
134
CVEs
5
3
3
2
1
IDS Classtypes
13
11
11
9
8
IDS Protocols
62
1
Detects unauthenticated or anonymous access attempts to cloud storage buckets, specifically targeting Azure Blob Storage and AWS S3. The rule identifies access to publicly exposed buckets or those with anonymous access enabled, including specific bucket names associated with known OPSEC failures (pois43, w456w5, sentiwaw). This could indicate data exposure or reconnaissance by unauthorized actors.
Detects Node.js attempting to query the AWS/GCP internal metadata IP (169.254.169.254) to extract cloud instance IAM roles. This activity is associated with the Stitch-SDK scope squatting credential harvester.
This rule detects the use of common cloud command-line interfaces (Azure CLI, Azure PowerShell, and AWS CLI) to perform resource discovery, specifically identifying commands used to list virtual machines or describe EC2 instances. Such activity, if performed by an unexpected user or on an endpoint where cloud management tools are not typically installed, may indicate reconnaissance by an adversary.
Detects an AI agent (manipulated by a poisoned recommendation prompt) attempting to access internal Cloud Metadata endpoints (e.g., AWS IMDS, Azure IMDS) to steal underlying infrastructure tokens.
Detects potential S3 bucket exfiltration attempts originating from command-line interface (CLI) tools or Node.js applications. The rule specifically looks for network connections to AWS S3 regional endpoints (us-west or us-east) initiated by processes named 'node.exe', 'python.exe', or 'aws.exe'.
Detects the initial phishing delivery vector: Microsoft Teams spawning a process which downloads from AWS S3 buckets.
Detects the unique URL structures matching the Service Worker DGA targeting randomized Amazon S3 buckets, indicative of potential command and control communication.
Detects network connection attempts to the cloud Instance Metadata Service (IMDS) endpoint (169.254.169.254) initiated by processes that are not known cloud management agents or system utilities, which may indicate unauthorized credential or IAM role token theft.
Detects CI/CD runner agents calling 'aws configure list-profiles' and connecting to a known malicious IP address (216.126.225.129), as prescribed by the Megalodon CI/CD malware.
Detects bulk download of AWS S3 objects indicating cloud data theft
Detects one-way C2 communication via data drops to cloud storage services
Detects access to AWS credentials files for cloud account credential theft
Detects suspicious AWS Lambda function invocations
Detects retrieval of secrets from AWS Secrets Manager
Detects creation of cloud accounts for establishing attack infrastructure
Detects retrieval of secrets from AWS Secrets Manager
Detects unauthorized processes reading the .bash_history file concurrently with AWS CLI activity, which could indicate an adversary attempting to extract credentials or sensitive information from command history while interacting with AWS services. This behavior is associated with the Megalodon CI/CD malware.
Detects creation of additional IAM access keys for cloud account persistence
Detects deletion of cloud security group rules to weaken network security
Detects bulk AWS API calls for cloud infrastructure discovery
Detects cloud services being used to move laterally between cloud resources
Page 23 of 46