Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
960 detections
Filters
Last updated
All Time
Detection languages
215
211
197
168
63
Contributors
283
142
113
112
85
Categories
670
218
168
112
95
Platforms
39,936
7,266
6,537
3,866
3,647
960
Products / Services
713
68
64
59
59
MITRE Techniques
310
305
146
136
134
CVEs
5
3
3
2
1
IDS Classtypes
13
11
11
9
8
IDS Protocols
62
1
This rule detects large HTTP PUT requests (over 50KB) directed towards common cloud storage services (Amazon S3, Azure Blob Storage, Google Cloud Storage). This activity could indicate data exfiltration to an external cloud account.
This rule detects HTTP PUT requests to s3.amazonaws.com that include the 'x-amz-copy-source' header and have a data size greater than 1000 bytes. This combination of indicators suggests an attempt to copy data from one S3 bucket to another, potentially indicating data exfiltration to an attacker-controlled AWS account.
This rule detects HTTP traffic indicating a potential cloud service compromise for cryptomining. Specifically, it looks for HTTP requests to 'ec2.amazonaws.com' with the URI containing 'RunInstances' and the client body containing 'p3' (case-insensitive). This combination suggests an attempt to provision EC2 instances, possibly for cryptomining, using a compromised AWS account.
This rule detects attempts to stage large amounts of data (over 65KB) to common cloud storage services (Amazon S3, Azure Blob Storage, Google Cloud Storage) via HTTP PUT requests. This activity is indicative of data being prepared for exfiltration.
This rule detects a high volume of HTTP GET requests to AWS S3 buckets from a single source IP address within a short timeframe. Specifically, it triggers if more than 50 GET requests are observed within 60 seconds to hosts matching 's3.amazonaws.com' or '.s3.' patterns. This behavior can indicate an attempt to exfiltrate data or perform bulk collection from an S3 bucket.
This rule detects AWS IAM user account enumeration attempts via the ListUsers API call. It triggers when five or more HTTP requests to 'iam.amazonaws.com' containing 'ListUsers' in the URI are observed from a single source IP within a 30-second window. This behavior is indicative of an attacker trying to discover valid IAM user accounts.
This rule detects multiple AWS console login attempts from a single source IP address within a short timeframe, specifically looking for access to the 'home' URI on 'console.aws.amazon.com'. This behavior could indicate an attacker attempting to discover cloud resources after gaining initial access to an AWS account.
This rule detects attempts to enumerate AWS S3 object lists, which could indicate data discovery activities. It specifically looks for HTTP requests to s3.amazonaws.com or .s3-website domains containing the string 'list' in the URI, with a threshold of 10 occurrences within 30 seconds from the same source.
This rule detects HTTP traffic where the host header contains specific cloud region identifiers that are considered rarely used. The rule is triggered if 10 such events occur within 60 seconds from the same source IP address. The identified regions are 'ap-east-1', 'me-south-1', 'af-south-1', and 'eu-south-1'. This could indicate an attempt to evade detection by using less common cloud infrastructure or an unauthorized API call from an unusual geographic location.
This rule detects attempts to delete a cloud security group rule via the AWS EC2 API. Specifically, it looks for HTTP traffic to 'ec2.amazonaws.com' with the URI containing 'RevokeSecurityGroupIngress', which is the API call used to remove an inbound rule from a security group.
This rule detects HTTP traffic indicating an Amazon EC2 instance is being reverted to a snapshot. Specifically, it looks for HTTP requests to 'ec2.amazonaws.com' with the URI containing 'RestoreSnapshotTier'. This activity could be part of a cleanup process or an attempt to restore a compromised instance to a known good state, but could also be used by an attacker for defense evasion by reverting changes.
This rule detects attempts to create new cloud instances, specifically targeting AWS EC2, by monitoring HTTP traffic for requests to 'ec2.amazonaws.com' with the 'RunInstances' URI. The rule is designed to identify suspicious activity related to the provisioning of new virtual machines in a cloud environment, potentially indicating unauthorized resource creation or evasion tactics.
This rule detects HTTP POST requests to AWS Lambda invocation endpoints, specifically targeting URLs matching the pattern '/lambda.[a-z0-9-]+.amazonaws.com' with the URI '/invocations'. A threshold of 20 such requests within 60 seconds from a single source IP triggers the alert, indicating potential code execution activity via AWS Lambda.
This rule detects attempts to upload executable files (specifically Windows MZ executables) to common cloud storage services like Amazon S3, Google Cloud Storage, and Azure Blob Storage. It looks for HTTP PUT requests containing the 'MZ' magic bytes at the beginning of the file data, indicating a Windows executable, with a file size greater than 100KB, directed towards known cloud storage domains.
This rule detects HTTP requests attempting to access the AWS EC2 Instance Metadata service, specifically targeting the 'latest/meta-data' endpoint. This service, typically found at the IP address 169.254.169.254, provides information about the running EC2 instance, including credentials and other sensitive data. Unauthorized access to this endpoint can indicate an attacker attempting to gain further access or information within an AWS environment.
This rule detects HTTP requests to the AWS EC2 service (ec2.amazonaws.com) that specifically attempt to enumerate Amazon Machine Images (AMIs) using the 'DescribeImages' API call. This activity could indicate an attacker performing reconnaissance to understand the available virtual machine images within an AWS environment.
This rule detects HTTP traffic indicating an attempt to terminate an EC2 instance on AWS. Specifically, it looks for HTTP requests to 'ec2.amazonaws.com' with 'TerminateInstances' in the URI, which is a common API call used to delete cloud instances. This activity could be performed by an attacker to remove evidence of their presence or to disrupt services.
This rule detects when a cloud disk snapshot is created, specifically targeting AWS EC2 'CreateSnapshot' API calls. This activity can be indicative of data exfiltration attempts, where an attacker creates a snapshot of a compromised disk to move data out of the environment.
This rule detects when an AWS Organization Unit (OU) is modified, specifically when the 'MoveAccount' API call is made to 'organizations.amazonaws.com'. This activity could indicate an attempt to evade detection or alter the organizational structure for malicious purposes.
This rule detects the exfiltration of AWS temporary credential tokens over HTTP. It specifically looks for HTTP client body content containing both "ASIA" (which is a common prefix for AWS temporary access keys) and "aws_session_token" (the parameter name for the session token). The detection is case-insensitive and targets established HTTP connections where data is flowing from the client to the server.
This rule detects when an AWS IAM user policy is attached, specifically looking for the 'AttachUserPolicy' action on 'iam.amazonaws.com'. This could indicate an attempt to escalate privileges or grant new permissions to a compromised account.
Page 26 of 46