Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detects when an AWS Route 53 domain is transferred to another AWS account. This activity could indicate an attempt by an adversary to maintain persistence or exfiltrate domain control by moving it to an account they control.
This rule identifies suspicious activity related to Security Assertion Markup Language (SAML) in AWS. Specifically, it looks for two events: `AssumeRoleWithSAML` from the `sts.amazonaws.com` service and `UpdateSAMLProvider` from the `iam.amazonaws.com` service. An adversary could leverage these actions to gain unauthorized access, establish persistence, or escalate privileges within an AWS environment by manipulating SAML providers or assuming roles via SAML.
Detects the use of the 'EnableRegion' command in AWS CloudTrail logs. This command allows an AWS account to enable additional regions. Monitoring this activity is crucial because adversaries might enable new, less-monitored regions to establish persistence, exfiltrate data, or conduct other malicious activities, potentially bypassing existing security controls that are not configured for these new regions.
Detects access to Okta admin functions through proxy.
Detects the S3 Browser utility performing reconnaissance by checking for existing AWS IAM Users without a LoginProfile defined, and subsequently creating a LoginProfile if one is not found. This behavior has been associated with the Guivil threat actor.
Detects changes to the AWS Identity Center (formerly AWS SSO) identity provider configuration. Such changes, including associating, disassociating, enabling, or disabling an external identity provider, could be used by an attacker to establish persistent access or escalate privileges through user impersonation.
This rule identifies when an admission controller is executed in Azure Kubernetes. Admission controllers intercept and potentially modify requests to the Kubernetes API server. Adversaries can leverage admission webhooks (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) for persistence, such as injecting malicious containers into pods or intercepting API requests to steal credentials and sensitive information.
Detects when a transfer lock was removed from an AWS Route 53 domain. This action is typically performed when intending to transfer the domain to a different registrar, but it can also be an indicator of malicious activity if unauthorized. Disabling the transfer lock makes the domain vulnerable to unauthorized transfers, which could lead to domain hijacking or redirection of traffic.
Detects the deletion of one or more VPC Flow Logs in AWS Elastic Compute Cloud (EC2) through the DeleteFlowLogs API call. Adversaries may delete flow logs to evade detection or remove evidence of network activity, hindering forensic investigations and visibility into malicious operations.
Detects the creation of an Inline IAM policy by the 'S3 Browser' utility, where the policy still contains the default S3 bucket name placeholder value of "<YOUR-BUCKET-NAME>" instead of a specific bucket name. This indicates a potential misconfiguration or an attempt to create a broad policy that might be further exploited.
Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.
Detects when the policy allowing forks of private and internal repositories is changed (enabled or cleared).
Detects when a GitHub Pages site of a repository is made public. This usually is part of a publishing process but could indicate or lead to potential unauthorized exposure of sensitive information or code.
The following analytic detects the creation of an AWS DataSync task, which could indicate potential data exfiltration. It leverages AWS CloudTrail logs to identify the `CreateTask` event from the DataSync service. This activity is significant because attackers can misuse DataSync to transfer sensitive data from a private AWS location to a public one, leading to data compromise. If confirmed malicious, this could result in unauthorized access to sensitive information, causing severe data breaches and compliance violations.
KQL Query
Detects when a request has been made to transfer a Route 53 domain to another AWS account.
Detects the execution of TruffleHog, a popular open-source tool used for scanning repositories for secrets and sensitive information, within an AWS environment.
It has been reported to be used by threat actors for credential harvesting. All detections should be investigated to determine if the usage is authorized by security teams or potentially malicious.
It has been reported to be used by threat actors for credential harvesting. All detections should be investigated to determine if the usage is authorized by security teams or potentially malicious.
Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. This activity is uncommon and provides a high certainty signal.
This rule detects attempts to access non-existent AWS S3 buckets, indicated by the 'NoSuchBucket' error code in CloudTrail logs. This could signify reconnaissance activities by an attacker attempting to enumerate accessible S3 buckets or misconfigurations in applications trying to access buckets that no longer exist or have incorrect names. The rule extracts the bucket name and host from the request parameters for further investigation.
Detects activity when someone is changing passwords on behalf of other users.
An attacker with the "iam:UpdateLoginProfile" permission on other users can change the password used to login to the AWS console on any user that already has a login profile setup.
An attacker with the "iam:UpdateLoginProfile" permission on other users can change the password used to login to the AWS console on any user that already has a login profile setup.
Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.
Page 109 of 135