Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
2
Contributors
2
Categories
1
1
1
Platforms
40,209
7,385
6,553
3,917
3,693
Products / Services
1
1
1
MITRE Techniques
1
1
1
1
1
Detects AWS API activity linked to the ARTEX and AntiFox agentic pentest frameworks: published source IPs, the tool name in the user agent, CloudWatch log searches for keys and passwords, placeholder S3 object probes and fast enumeration across many services with many denied calls. Needs CloudTrail in Sentinel, and S3 probes need data events. The enumeration branch skips IAM Identity Center sessions, browser user agents and Lambda automation. Logic tested with synthetic events and run against live CloudTrail data.
Detects PIM role activations and eligible or active role assignments that involve Entra agent users. Agents are identified by agentType, blueprintId or a maintained UPN list.
Review notes:
- The agentType and blueprintId branches are not validated against real agent user events.
- The UPN list is the only validated signal.
- The UPN list is manual and needs an owner and a review cadence.
- For a scheduled analytic rule, set Lookback to match the run frequency (for example 1d).
Entity mapping: Account: ActorUpn; Account: TargetUser (Actor intentionally not mapped).
Review notes:
- The agentType and blueprintId branches are not validated against real agent user events.
- The UPN list is the only validated signal.
- The UPN list is manual and needs an owner and a review cadence.
- For a scheduled analytic rule, set Lookback to match the run frequency (for example 1d).
Entity mapping: Account: ActorUpn; Account: TargetUser (Actor intentionally not mapped).