Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
54 detections
Filters
Last updated
All Time
Detection languages
15
12
9
9
6
Contributors
33
8
5
3
1
Categories
24
22
13
12
11
Platforms
39,936
7,266
6,537
3,866
3,647
54
Products / Services
13
13
9
7
6
MITRE Techniques
18
13
12
11
10
CVEs
1
1
IDS Classtypes
3
2
2
2
IDS Protocols
5
4
Detects access to sensitive GCP credential-related files or the presence of credential-related environment variables/secrets in command lines and network request bodies. This pattern is often associated with the theft of service account keys or environment-based cloud credentials, frequently seen in serverless or containerized environments.
This rule monitors the creation of new Azure Function Apps and identifies those that receive external, non-private network requests within 48 hours of their creation. This pattern may indicate the deployment of malicious or unauthorized serverless infrastructure for command-and-control, proxying, or automated tasks.
Detects suspicious AWS Lambda function invocations
Detects serverless function deployments used as C2 infrastructure
Detects suspicious AWS Lambda function invocations
Detects compromised serverless functions being used as C2 relay infrastructure
Detects serverless function deployments used as C2 infrastructure
This rule detects HTTP requests where the 'Host' header matches patterns commonly associated with serverless function domains, specifically AWS Lambda URLs, Azure Websites, and Google Cloud Functions. The rule is designed to identify potential command and control (C2) infrastructure utilizing serverless platforms. It triggers an alert if 10 such requests are observed from a single source IP within a 60-second window.
This rule detects HTTP POST requests to AWS Lambda invocation endpoints, specifically targeting URLs matching the pattern '/lambda.[a-z0-9-]+.amazonaws.com' with the URI '/invocations'. A threshold of 20 such requests within 60 seconds from a single source IP triggers the alert, indicating potential code execution activity via AWS Lambda.
This rule detects potential command and control (C2) communication originating from a compromised serverless function. It specifically looks for HTTP POST requests with a body size greater than 500 bytes, targeting domains associated with serverless platforms like Vercel (.vercel.app), Netlify (.netlify.app), and Cloudflare Pages (.pages.dev). A threshold of 10 such requests within 60 seconds from the same source IP triggers the alert, indicating a possible high-volume data exfiltration or C2 activity.
Detects web requests to Cloudflare workers.dev subdomains containing specific keywords commonly used in the EvilTokens phishing campaign lures. Attackers rely on this PaaS platform to host device code phishing pages and bypass domain reputation checks.
This rule detects suspicious outbound network connections to Cloudflare Workers domains, indicative of potential command and control (C2) activity. It identifies connections to known malicious Cloudflare Workers domains or IPs, as well as generic Cloudflare Workers domains (.workers.dev) when initiated by suspicious processes like `WsusService.exe`, `curl.exe`, `certutil.exe`, `bitsadmin.exe`, `Velociraptor.exe`, or `msiexec.exe`. The rule prioritizes detection based on specific indicators like known malicious workers or C2 IPs, and flags activity from processes commonly abused for C2 or payload delivery. It also provides severity scoring and investigation steps based on the identified threat type.
Page 3 of 3