Lacey Cochrane
@NullVectorXUSTrusted contributorCompletionist
11 followers159 downloads2,514 copies56 likes67,916 views
245 detections
Filters
Last updated
All Time
Detection languages
245
Categories
73
66
54
29
29
Platforms
83
58
36
26
24
Products / Services
35
26
23
21
19
MITRE Techniques
79
70
46
44
42
CVEs
4
4
AWS Console Brute Force Activity
Cortex XDR
Detects repeated failed AWS console login attempts from the same IP address within a one-hour window, indicating a potential brute-force attack against AWS accounts.
This rule detects the creation of Amazon SNS (Simple Notification Service) subscriptions that are configured to send notifications to external HTTP or HTTPS endpoints. It specifically looks for `Subscribe` events from the `sns.amazonaws.com` service where the `protocol` is either `http` or `https` and the `endpoint` does not belong to Amazon's own domains (amazon.com, awsapps.com, amazonaws.com). This could indicate data exfiltration or misconfiguration where sensitive information might be sent to an unapproved external service.
AWS SES Email Enumeration Detection
Cortex XDR
Detects enumeration of AWS SES email identities and sending quotas. This activity can indicate an attacker performing reconnaissance before launching phishing or Business Email Compromise (BEC) attacks. The rule identifies multiple distinct SES operations related to identity and quota checks performed by a single user within a two-hour window.
This rule detects potential GraphRunner activity in Azure environments by identifying suspicious authentication attempts to Microsoft Graph using the 'deviceCode' authentication protocol, combined with specific user agent strings associated with the GraphRunner tool. It categorizes detections into high confidence (both device code and suspicious user agent), device code authentication only, or suspicious user agent only.
AWS Region Enablement Detection
Cortex XDR
Detects when a commonly abused or dormant/opt-in AWS region is enabled in an account. Adversaries may enable unused AWS regions to evade detection, deploy resources for malicious activities like cryptocurrency mining, or to establish persistence outside of actively monitored regions.
Azure Blob Anonymous Access
Cortex XDR
Detects unauthenticated or anonymous access attempts to Azure Blob Storage. This rule identifies successful operations where the identity is explicitly listed as 'anonymous', indicating potential misconfigurations or unauthorized access to sensitive data.
Azure Impossible Travel Detection
Cortex XDR
Detects an identity signing in from two or more distinct geolocations within a one-hour window in Azure, indicating potential impossible travel activity.
This rule detects the installation of suspicious extensions on Azure Virtual Machines. These extensions, such as CustomScriptExtension, RunCommandHandler, DSCExtension, AADLoginForWindows, and NetworkWatcherAgent, can be abused by attackers for various purposes including remote code execution, configuration manipulation, unauthorized account access, or network reconnaissance. Monitoring their installation can help identify potential compromise or malicious activity within an Azure environment.
Large Azure Blob Downloads
Cortex XDR
Detects an identity downloading an unusually high number of blobs (more than 100) from Azure Storage within a one-hour window. This could indicate data exfiltration or unauthorized bulk access to cloud storage.
This rule detects unusual access patterns to Azure resources where a single identity (user or service principal) accesses resources from multiple distinct IP addresses and/or geographic locations within a 7-day timeframe. This behavior can indicate compromised credentials, session hijacking, or an adversary attempting to evade detection by frequently changing their apparent origin.
Page 21 of 25