Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
960 detections
Filters
Last updated
All Time
Detection languages
215
211
197
168
63
Contributors
283
142
113
112
85
Categories
670
218
168
112
95
Platforms
39,936
7,266
6,537
3,866
3,647
960
Products / Services
713
68
64
59
59
MITRE Techniques
310
305
146
136
134
CVEs
5
3
3
2
1
IDS Classtypes
13
11
11
9
8
IDS Protocols
62
1
Detects serverless function deployments used as C2 infrastructure
Detects bulk download of AWS S3 objects indicating cloud data theft
Detects unexpected processes requesting AWS IMDSv2 tokens from the link-local address 169.254.169.254. This activity can indicate an attempt to steal temporary cloud credentials from compromised EC2 instances, as seen with malware like Miasma.
Detects unusual processes querying the AWS ECS metadata endpoint (169.254.170.2) to harvest container-level IAM roles and secrets. This rule specifically looks for network connections to the ECS metadata endpoint from processes commonly used for scripting or data transfer, such as node, bun, curl, and wget.
Detects suspicious AWS STS AssumeRole calls for temporary elevated access
Detects enumeration of S3 bucket objects for cloud data discovery
Detects upload of offensive security tools to cloud storage for staging
Detects suspicious AWS Lambda function invocations
Detects bulk AWS API calls for cloud infrastructure discovery
This rule detects attempts to disable AWS CloudTrail logging via the AWS API. It specifically looks for HTTP requests to 'cloudtrail.amazonaws.com' with 'StopLogging' in the URI, indicating an attempt to stop CloudTrail from recording API activity.
Detects Python processes accessing sensitive credential paths, a common post-exploitation step for malicious ML models (e.g., CVE-2026-4372). The rule specifically looks for Python executables accessing paths commonly associated with cloud (AWS) or container (Kubernetes) credentials. It includes exclusions for known legitimate ML pipeline scripts to reduce noise.
Detects cloud resources created in rarely used geographic regions for evasion
Detects modification of AWS organizational units to evade policy controls
Detects cloud instance creation in unusual regions for evasion
Detects disabling of AWS CloudTrail audit logging
Detects AWS Systems Manager Run Command used for remote code execution on EC2 instances
Detects cloud services being used to move laterally between cloud resources
Detects modification of cloud instance attributes for evasion or persistence
This rule detects attempts to use cloud services (specifically AWS SSM or Azure Management) for internal lateral movement. It triggers when HTTP requests are made to 'ssm.amazonaws.com' or 'management.azure.com' with the URI containing 'SendCommand'. A threshold of 5 such events from the same source within 30 seconds is set to reduce false positives.
This rule detects attempts to create new accounts on major cloud platforms (AWS, Azure, Google Cloud) by monitoring HTTP traffic for specific hostnames and the 'signup' keyword in the URI. It specifically looks for connections to 'aws.amazon.com', 'portal.azure.com', or 'console.cloud.google' with 'signup' in the URI, indicating a potential account creation activity.
Detects modification of cloud compute infrastructure to evade detection or remove evidence
Page 24 of 46