Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
54 detections
Filters
Last updated
All Time
Detection languages
15
12
9
9
6
Contributors
33
8
5
3
1
Categories
24
22
13
12
11
Platforms
39,936
7,266
6,537
3,866
3,647
54
Products / Services
13
13
9
7
6
MITRE Techniques
18
13
12
11
10
CVEs
1
1
IDS Classtypes
3
2
2
2
IDS Protocols
5
4
Detects a burst of failed authentications against Zimbra. Internet-facing webmail is
among the most consistently attacked surfaces in any estate, and Zimbra deployments
frequently sit outside the identity controls applied to the rest of the organisation.
Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='ZIMBRA' and action='LOGIN'
| duration 15m
| groupby srcip, reason
| select srcip, reason, distinct_count(user)
| having distinct_count_col1 > 10
among the most consistently attacked surfaces in any estate, and Zimbra deployments
frequently sit outside the identity controls applied to the rest of the organisation.
Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='ZIMBRA' and action='LOGIN'
| duration 15m
| groupby srcip, reason
| select srcip, reason, distinct_count(user)
| having distinct_count_col1 > 10
Detects adversarial backdoor triggers (such as pixel patches, watermark-like artifacts, or malicious token sequences) injected into AI inference inputs. The rule identifies these inputs by observing a combination of suspicious trigger patterns and significant, anomalous jumps in prediction confidence directed at a specific target class, indicative of a model integrity compromise.
Detects the creation or modification of serverless functions (AWS Lambda, Azure Function Apps, GCP Cloud Functions) that exhibit high-risk configurations. These include functions assigned overly permissive IAM roles, configured for public or unauthenticated invocation, or tied to event triggers commonly abused for persistence in cloud environments.
Detects instances where a principal utilizes the iam:PassRole permission to assign a role with higher privileges to a newly created or updated compute resource (Lambda or EC2), potentially allowing the principal to assume the identity and elevated permissions of the passed role.
Detects adversarial AI cost harvesting (AML.T0034.000) by identifying anomalous volumes of low-complexity queries against an AI inference API that result in a significant, unexplained spike in billed costs. This behavior mimics denial-of-service tactics aimed at exhausting compute capacity and financial resources.
Detects unauthorized modifications to AWS Bedrock Agent configurations, specifically identifying high-risk activities such as rewriting system prompts for potential prompt injection or attaching cross-account Lambda functions. The rule monitors for UpdateAgent, CreateAgentActionGroup, UpdateAgentActionGroup, and PrepareAgent events.
This rule detects network traffic patterns associated with ARToken-style OAuth device code phishing attacks, specifically monitoring for initial backend requests to Cloudflare Workers infrastructure, response payloads containing known phishing template indicators, and subsequent polling activity against device code endpoints that indicate an active phishing session.
Detects the use of iam:PassRole to attach a potentially highly privileged IAM role (e.g., Administrator, PowerUser, FullAccess) to newly created or modified compute or serverless resources (EC2 instances, Lambda functions, Launch Templates, or Auto Scaling Groups). This behavior is indicative of an attacker attempting to escalate privileges by granting a managed resource excessive permissions that the attacker can subsequently abuse.
Detects modifications to AWS Lambda functions that indicate potential backdooring, specifically unauthorized resource policy grants (lambda:InvokeFunction with a wildcard principal) or unexpected function code/configuration updates. This activity enables persistent, low-visibility execution by leveraging existing function permissions.
Detects modifications to AWS Lambda functions that indicate potential backdooring, specifically unauthorized resource policy grants (lambda:InvokeFunction with a wildcard principal) or unexpected function code/configuration updates. This activity enables persistent, low-visibility execution by leveraging existing function permissions.
Detects the creation of AWS Lambda functions by non-standard principals that assign an execution role with potentially broader privileges than the creator, indicative of an IAM privilege escalation technique where an attacker abuses iam:PassRole and lambda:CreateFunction to execute code under an elevated identity.
Detects the creation or modification of AWS Lambda functions that are associated with high-privilege IAM actions and triggered by EventBridge rules monitoring sensitive events like IAM user creation or console logins. This pattern indicates an attempt to establish event-driven, persistent backdoors within the AWS environment by automating malicious actions on new users or logins.
Detects potential backdoored persistence in AWS Lambda functions. The rule monitors for two patterns: 1) A Lambda function creation followed by granting cross-account 'lambda:InvokeFunction' permissions to an untrusted or wildcard principal. 2) A privilege escalation event (such as attaching policies) followed by a 'lambda:UpdateFunctionCode' operation on the same function by the same principal, which may indicate an attempt to inject malicious code into a serverless function.
Detects the creation of an AWS Lambda function that is assigned an excessively privileged execution role (e.g., AdministratorAccess). Attackers often leverage this technique to establish persistence or facilitate privilege escalation by creating backdoored functions that run with broad administrative permissions.
This rule detects network traffic patterns associated with the ARToken phishing campaign, specifically identifying access to lure pages hosted on 'workers.dev' domains with 'docviewer' in the hostname and 'turnstile' challenge responses in the HTTP body, which is used for anti-analysis/evasion.
Detects attempts to perform context or memory poisoning against an AI agent by injecting imperative, instruction-like payloads into the agent's long-term memory or context store. The rule specifically monitors updates originating from untrusted channels, such as tool outputs, external documents, or web content, which contain patterns commonly associated with prompt injection attacks (e.g., overriding system instructions or role definitions).
Detects instances where AI agents are activated through external communication channels like webhooks, email, or chat, and the provided payload includes potentially malicious imperative instructions (e.g., 'delete', 'execute', 'send credentials'). The detection logic excludes activity originating from trusted, allow-listed internal sources to reduce false positives.
Detects adversarial attempts to infer whether specific records were used in an AI model's training set by analyzing raw prediction confidence scores and identifying suspicious query patterns such as near-duplicate submissions or systematic sweeps.
Detects network activity associated with a phishing campaign leveraging Cloudflare Workers, identified as 'ARToken'. The rules monitor for specific TLS SNI patterns, HTTP Host headers, and subsequent C2-like behavior involving device code authentication flows (api/device/start and api/device/poll) hosted on 'workers.dev'.
Detects anomalous query patterns against an AI inference API, characteristic of a membership inference attack. The rule identifies callers submitting a high volume of near-duplicate or minimally-perturbed inputs while requesting raw confidence scores, suggesting an attempt to probe the model to determine if specific data points were used in its training set.
This rule detects command-and-control (C2) communication patterns associated with the 'soraki-proxy.workers.dev' domain, a Cloudflare Workers-hosted proxy service. Additionally, it identifies potential malicious mTLS implants by flagging non-standard TLS handshakes that use self-signed or auto-generated certificates missing standard organization (O) fields in the subject DN.
Page 1 of 3