Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
This rule detects changes to self-hosted GitHub Actions runner configurations. These changes include actions such as removing a self-hosted runner from an organization or repository, creating or removing runner groups, and adding, removing, or updating runners within a runner group. Such modifications can indicate administrative actions related to CI/CD infrastructure, which should be validated for legitimacy.
Detects the execution of TruffleHog, an open-source tool used for scanning repositories for secrets and sensitive information, within an AWS environment. This activity can indicate credential harvesting by threat actors. All detections should be investigated to determine if the usage is authorized by security teams or potentially malicious.
https://www.proofpoint.com/us/blog/threat-insight/beyond-credentials-weaponizing-oauth-applications-persistent-cloud-access
Detects when an API access service account is granted domain authority within Google Workspace. This action can be used by an attacker to gain persistent and elevated access to an organization's Google Workspace data and services by allowing a service account to impersonate users across the domain.
Detects potentially suspicious events involving "GetSigninToken" in AWS. An adversary using the "aws_consoler" tool can leverage this console API to create temporary federated credentials, which can help obfuscate the compromised AWS credential (the original access key) and enable pivoting from the AWS CLI to console sessions without requiring MFA, using the newly issued access key.
Detects the use of TruffleHog for AWS credential validation by identifying GetCallerIdentity API calls where the userAgent indicates TruffleHog. Threat actors leverage TruffleHog to enumerate and validate exposed AWS keys. Successful exploitation allows threat actors to confirm the validity of compromised AWS credentials, facilitating further unauthorized access and actions within the AWS environment.
Detects when an Azure Blob Storage container's access level is changed to allow public access, or when a long-lived, highly privileged Shared Access Signature (SAS) token is created. Threat actors can use these methods for persistence and data exfiltration.
This rule detects when a user successfully elevates their permissions to manage all Azure Subscriptions. This action grants broad access across the Azure environment and should be immediately investigated if it is not a planned administrative activity. Such an elevation could be leveraged by an attacker to gain extensive control over Azure resources.
Detects AWS console logins from countries and IP addresses that are not recognized as legitimate for the organization. This alert can help identify potential unauthorized access attempts from unusual locations, which may indicate compromised credentials or malicious activity.
This rule identifies suspicious usage of the AWS Security Token Service (STS) `AssumeRole` API call. Specifically, it looks for instances where the `userIdentity.type` is `AssumedRole` and the `userIdentity.sessionContext.sessionIssuer.type` is `Role`. This pattern indicates that an AWS role is being assumed by another role, which could be a legitimate administrative action but also a technique used by attackers for lateral movement and privilege escalation within an AWS environment. Attackers might use `AssumeRole` to switch to roles with higher privileges or to move between different accounts or services after gaining initial access.
Identifies when a user grants permissions to another user on Azure resources. The rule specifically looks for the 'Microsoft.Authorization/roleAssignments/write' operation in Azure Activity Logs, which indicates a role assignment creation or modification. This can be an indicator of privilege escalation or persistence.
Identifies when an admission controller is executed in GCP Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.
Detects the import of SSH key pairs into AWS EC2, which may indicate an attacker attempting to gain unauthorized access to instances. This activity could lead to initial access, persistence, or privilege escalation, potentially compromising sensitive data and operations.
Detects the deletion of S3 buckets in AWS CloudTrail logs. Monitoring the deletion of S3 buckets is critical for security and data integrity, as it may indicate potential data loss or unauthorized access attempts.
Detects the deletion of an AWS SAML provider, which could indicate an attacker attempting to disrupt administrative or security team access. By removing the SAML provider, an adversary can hinder the ability of security personnel or system administrators to investigate and respond during an attack.
Detects the deployment of container workloads in Google Cloud Platform (GCP) that utilize the 'break-glass' flag to bypass Binary Authorization controls. This indicates an intentional override of security policies designed to ensure only trusted images are deployed, potentially allowing unauthorized or malicious container images to run.
Detects activity when an AWS user's login profile (password) is modified by another user. This can indicate an attacker with the "iam:UpdateLoginProfile" permission is changing passwords on behalf of other users to gain access to the AWS console.
This rule detects the creation of AWS API keys for a user by a different user. This activity is indicative of a backdoored user account being used to establish persistence within an AWS environment. It can also help identify unusual flows of AWS key creation within an organization.
Detects the S3 Browser utility creating an IAM User or AccessKey in AWS. This activity can be indicative of an attacker establishing persistence or escalating privileges within an AWS environment.
This rule identifies the suspicious use of the AWS Security Token Service (STS) API call `GetSessionToken`. This API call is used to request temporary, limited-privilege credentials for an IAM user or role. Attackers may use `GetSessionToken` to generate temporary tokens to move laterally within an AWS environment or escalate privileges by assuming roles with broader permissions. The rule specifically looks for `GetSessionToken` calls made by an `IAMUser`.
This rule detects the creation of virtual machines or the deployment of resources within an Azure environment. Monitoring these activities can help identify unauthorized resource provisioning, which could indicate an attacker establishing persistence, escalating privileges, or preparing for further malicious actions. The rule specifically looks for 'write' operations related to virtual machines and resource deployments in Azure activity logs.
Page 108 of 135