Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
461 detections
Filters
Last updated
All Time
Detection languages
134
111
68
41
32
Contributors
136
63
56
49
29
Categories
264
153
62
60
59
Platforms
39,936
7,266
6,537
3,866
3,647
461
Products / Services
260
63
57
52
51
MITRE Techniques
148
103
61
58
58
CVEs
3
2
2
1
1
IDS Classtypes
7
5
5
4
3
IDS Protocols
27
This rule detects attempts to exploit the LiteLLM proxy pass-through endpoint to interact with the cloud Instance Metadata Service (IMDS). Specifically, it identifies configuration attempts to route traffic to the IMDS IP (169.254.169.254) and subsequent requests to retrieve IAM security credentials, which is indicative of a Server-Side Request Forgery (SSRF) attack to steal cloud identity tokens.
This rule correlates email sender activity with network, cloud, and identity logs by matching traffic against a specific IP range (160.79.104.0/21) identified as malicious or suspicious. The rule flags instances where this range appears as an email sender IP or as a remote/source IP address across various infrastructure indices, potentially indicating adversary communication or exfiltration.
Detects Server-Side Request Forgery (SSRF) attempts targeting an MLflow server where an attacker-controlled HTTP redirect response forces the server to reach out to the cloud instance metadata service at 169.254.169.254. This rule specifically looks for HTTP 30x redirect status codes where the Location header contains the sensitive metadata service IP address.
Detects Server-Side Request Forgery (SSRF) attempts targeting an MLflow server where an attacker-controlled HTTP redirect response forces the server to reach out to the cloud instance metadata service at 169.254.169.254. This rule specifically looks for HTTP 30x redirect status codes where the Location header contains the sensitive metadata service IP address.
Detects anomalous login activity in Google Workspace characterized by a high volume of login failures (5 or more) originating from a single IP address. The rule identifies potential brute force or credential stuffing campaigns and flags instances where a successful login occurs following a burst of failure events from the same source.
Detects Server-Side Request Forgery (SSRF) attempts originating from the Grafana MCP (Model Context Protocol) process. The rule specifically monitors for instances where the 'grafana_api_request' tool is used in conjunction with a 'X-Grafana-URL' header targeting cloud metadata IP ranges (169.254.0.0/16), or where the host attempts to resolve GCP metadata domains ('metadata.google.internal'). This behavior is indicative of an attacker attempting to access cloud provider instance metadata to exfiltrate security credentials.
Detects the execution of common command-line utilities and tools used to enumerate virtual machines, hypervisors, and cloud instance information. Adversaries may perform this reconnaissance to identify virtualization environments, sandbox targets, or cloud infrastructure configurations.
Detects SSRF attempts targeting cloud metadata endpoints or internal/private network addresses.
Cortex Agent Exception Rule Created
Cortex XDR
Detects the creation of a new exception rule within the Cortex endpoint agent management configuration. Exception rules can be used to exclude specific files, processes, or behaviors from security prevention policies, potentially leading to a reduction in defensive coverage.
This rule detects suspicious outbound network connections from common container runtime processes (e.g., containerd.exe, dockerd.exe) to well-known cloud instance metadata services (169.254.169.254, 100.100.100.200) or suspicious attempts to access container image manifests, which are indicative of SSRF attacks, credential theft from the metadata API, or potential container escape attempts.
This rule detects suspicious outbound network connections from common container runtime processes (e.g., containerd.exe, dockerd.exe) to well-known cloud instance metadata services (169.254.169.254, 100.100.100.200) or suspicious attempts to access container image manifests, which are indicative of SSRF attacks, credential theft from the metadata API, or potential container escape attempts.
This rule identifies newly created cloud accounts (AWS or Google Cloud) that exhibit immediate and high-volume API activity within an hour of their creation. This pattern is indicative of resource hijacking, where attackers exploit promotional or startup cloud credits to perform unauthorized tasks, such as hosting proxied API services for resale.
KQL Query
Detects OAuth application authorization events where the granted scopes include highly sensitive access such as Gmail, Drive, or Admin APIs. This rule identifies potential consent phishing attacks where users are tricked into granting malicious third-party applications broad, unauthorized access to their Google Workspace account. The rule excludes common, expected applications like Google Cloud SDK or standard Google services.
Detects mass revocation of OAuth tokens by a user, which may indicate an attacker cleaning up evidence after data extraction, or legitimate administrative incident response activity.
Detects a Google Workspace OAuth application grant and application-specific password issuance occurring within 30 minutes of a suspicious/AiTM-flagged sign-in, indicating Gmail account takeover.
This rule detects attempts to access cloud instance metadata services (specifically Google Cloud's metadata service) initiated by processes commonly associated with Adobe Campaign Classic (nlserver or w3wp.exe). Such requests are often indicative of Server-Side Request Forgery (SSRF) attempts, where an attacker leverages an application-level vulnerability to probe internal cloud infrastructure for sensitive data or credentials.
This rule detects modifications to Google Workspace user account recovery methods, including the generation or deletion of 2SV (2-Step Verification) backup scratch codes, and changes to recovery email addresses or recovery phone numbers. These actions are often performed during account takeover attempts to establish persistence or facilitate bypassing MFA.
This rule detects modifications to administrative privileges in Google Workspace, including granting or revoking administrative roles and delegating administrative responsibilities. Such activities are critical security events that could indicate unauthorized privilege escalation, account compromise, or malicious administrative activity.
This rule monitors GCP VPC Flow logs for potential command and control (C2) or data exfiltration activity by identifying internal-to-external network connections that exhibit high novelty. It calculates the percentage of new destination IP addresses contacted by internal source IPs within a single day. Alerts are triggered when a source IP initiates connections to at least 20 unique external destinations, where at least 20% of those destinations have never been contacted by that source in the previous day. This behavioral analysis is designed to detect reconnaissance, scanning, or large-scale data exfiltration patterns.
This rule monitors GCP Audit logs for the creation or deletion of VPN tunnels. It classifies the actor (human vs. service account) and validates the source of the action against expected patterns such as the use of Terraform and authorized network sources. It highlights activity that deviates from standard infrastructure-as-code deployments or originates from unusual network sources, aiding in the detection of unauthorized or suspicious network configuration changes.
Page 9 of 22