Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detects modifications to cloud-based IAM trust policies or resource policies that grant access to an external account, tenant, or project. This activity can indicate an attacker attempting to establish persistent backdoor access via cross-account trust relationships, bypassing standard identity controls.
Detects modifications to cloud security guardrails including AWS Service Control Policies (SCPs), Azure Policy assignments/exemptions, and GCP Organization Policies. These actions may indicate an attempt to disable security controls or weaken organizational policy enforcement.
This rule detects scenarios where a new credential (password or key) is added to a service principal or application, followed by an authentication event using that service principal within a short window (1 hour). This pattern is indicative of potential credential injection or persistence attempts, where an attacker adds a secret and immediately leverages it to establish access.
This rule detects scenarios where a new credential (password or key) is added to a service principal or application, followed by an authentication event using that service principal within a short window (1 hour). This pattern is indicative of potential credential injection or persistence attempts, where an attacker adds a secret and immediately leverages it to establish access.
Detects OAuth application consent events where an application is granted a combination of 'offline_access' (allowing refresh token issuance) and email-read permissions. This pattern is commonly used by adversaries to establish persistent, long-term access to user mailboxes for data exfiltration or Business Email Compromise (BEC) activities, surviving password changes until the consent is explicitly revoked.
Detects the addition of certificate-type credentials (AsymmetricX509Cert, usage=Verify) to Microsoft Entra ID (Azure AD) applications or service principals. This behavior is indicative of an attacker adding an adversary-controlled certificate to impersonate an application or service principal to achieve persistent, long-lived access.
Detects modifications to Microsoft Entra ID (formerly Azure AD) cross-tenant access policies or B2B synchronization settings. Specifically, this rule monitors for the addition of new external partner tenants to trust lists or the relaxation of security controls such as MFA and compliant device requirements for external partner access.
Detects modifications to Microsoft Entra ID (formerly Azure AD) applications, service principals, or Application Proxy configurations that could be indicative of an adversary establishing persistent external access. This includes updates to external URLs, SSO settings, and authentication types, which are frequently used to facilitate persistence via malicious cloud application configurations.
Detects modifications to AWS S3 bucket policies, ACLs, or public access block settings that result in a bucket becoming publicly accessible. Attackers often leverage s3:PutBucketPolicy or similar permissions to make buckets public, allowing data exfiltration via anonymous HTTP requests and bypassing egress monitoring for direct API calls.
Detects the creation or modification of AWS IAM policies that grant administrative-level access (Action '*' on Resource '*') to a role, user, or group. This is a common technique used by attackers to gain or escalate privileges to full administrator access following initial foothold acquisition.
Detects the modification of AWS Security Groups where management ports (SSH, RDP, WinRM, or common database ports) are opened to the entire internet (0.0.0.0/0 or ::/0). This activity is indicative of creating a network-layer backdoor to maintain persistence or facilitate lateral movement within a cloud environment.
Detects the creation of an AWS IAM access key (CreateAccessKey) for the root account or identities with administrative naming conventions. This activity can indicate persistence establishment by an attacker who has gained high-privileged access, as new access keys provide a durable way to maintain programmatic control that bypasses standard session-based security controls.
Detects Azure Activity Log events where a Storage Account is modified to enable public network access, public blob access, or container-level public access. Such misconfigurations can lead to unauthorized data exposure and exfiltration by internet-based actors.
Detects the creation or modification of Kubernetes RoleBindings or ClusterRoleBindings that grant highly privileged roles (e.g., cluster-admin or wildcard permissions) to a subject. The detection includes behavioral analysis to identify ServiceAccount usage from unusual source IP addresses within a short timeframe, which may indicate account compromise and unauthorized privilege escalation.
Detects usage of AWS CloudShell followed by S3 data-plane activity (GetObject/PutObject) from users without a documented baseline or exhibiting geographic anomalies. This pattern is indicative of potential misuse of a pre-authenticated execution context to perform unauthorized data staging or access, often evading host-based EDR monitoring.
Detects the provisioning of high-performance compute instances (GPU or high-CPU) in AWS regions that fall outside of an established organizational baseline. This behavior is often associated with unauthorized resource hijacking (cryptomining) by adversaries leveraging compromised IAM principals to deploy infrastructure in regions with lower visibility or monitoring coverage.
This rule detects modifications to AWS IAM policies via PutUserPolicy, PutRolePolicy, AttachUserPolicy, or AttachRolePolicy where the policy grants excessive permissions (wildcard Actions and Resources) or attaches an AdministratorAccess policy. The rule also flags rapid escalations occurring within 15 minutes of new user, role, or access key creation to identify potential self-escalation or unauthorized privilege escalation attempts by existing identities.
Detects modifications to AWS S3 bucket policies, access control lists (ACLs), or public access block configurations that result in public bucket exposure. The rule specifically flags broad permissions such as 'AllUsers' or wildcard principal entities, and correlates these findings with AWS Config or Access Analyzer data to confirm public reachability.
Detects unauthorized sharing of AWS EBS snapshots or RDS snapshots to external, unapproved AWS accounts. This activity is often a precursor to data exfiltration, where an adversary creates a snapshot of a production resource and shares it with an account under their control to bypass existing identity-based access controls.
Detects the creation of new AWS IAM access keys, with specific filtering for cross-principal creation, creation for sensitive accounts (e.g., service, admin), or excessive key creation activity. This pattern is often used by adversaries for persistence or privilege escalation in cloud environments.
This rule detects suspicious activities targeting cloud management hierarchy, specifically identifying attempts to remove AWS accounts from organizations, disable policy enforcement, create rogue accounts, or hijack Azure subscriptions through unauthorized transfers or tenant changes. Such actions are often used by adversaries to bypass security guardrails, remove organizational visibility, or establish persistent unauthorized access within a cloud environment.
Page 11 of 135