Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
This rule identifies rare subscription-level operations in Azure, specifically focusing on actions that involve listing keys for various Azure resources (DocumentDB, Maps, Media, Cognitive Services, Storage) or writing snapshots and network security groups. It aims to detect when these sensitive operations are performed from a previously unseen source IP address, indicating potential unauthorized access or credential compromise.
Detects when an Azure Kubernetes Cluster is created or deleted. This activity can indicate significant infrastructure changes, either legitimate or malicious. Monitoring these operations is crucial for maintaining the security and integrity of containerized environments.
Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.
Once a user authenticates to the Azure AD PowerShell application, if they take multiple admin actions indicative of establishing their own persistence with an Entra ID application within a portion of the access token time, alert for additional investigation
Identifies when a Azure Kubernetes network policy is modified or deleted.
Detects when a Kubernetes Rolebinding is created or modified.
Detects when Kubernetes Secrets are Modified or Deleted.
Detects when a Container Registry is created or deleted.
Detects when a Azure Kubernetes Cluster is created or deleted.
Identifies when ClusterRoles/Roles are being modified or deleted.
Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.
Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.
Identifies when a service account is modified or deleted.
Detects when a Kubernetes CronJob or Job is created or modified.
A Kubernetes Job creates one or more pods to accomplish a specific task, and a CronJob creates Jobs on a recurring schedule.
An adversary can take advantage of this Kubernetes object to schedule Jobs to run containers that execute malicious code within a cluster, allowing them to achieve persistence.
A Kubernetes Job creates one or more pods to accomplish a specific task, and a CronJob creates Jobs on a recurring schedule.
An adversary can take advantage of this Kubernetes object to schedule Jobs to run containers that execute malicious code within a cluster, allowing them to achieve persistence.
Detects when an account dumps the LAPS password from Entra ID.
The analytic identifies access denied errors when attempting to invoke AWS Bedrock models. It leverages AWS CloudTrail logs to detect when a user or service receives an AccessDenied error when calling the InvokeModel API. This activity is significant as it may indicate an adversary attempting to access Bedrock models with insufficient permissions after compromising credentials. If confirmed malicious, this could suggest reconnaissance activities or privilege escalation attempts targeting generative AI resources, potentially leading to data exfiltration or manipulation of model outputs.
The following analytic identifies unauthenticated requests to Kubernetes cluster pods. It detects this activity by analyzing GCP Pub/Sub messages for audit logs where the response status code is 401, indicating unauthorized access attempts. This activity is significant for a SOC because it may indicate reconnaissance or scanning attempts by an attacker trying to identify vulnerable pods. If confirmed malicious, this activity could lead to unauthorized access, allowing the attacker to exploit vulnerabilities within the cluster, potentially compromising sensitive data or gaining control over the Kubernetes environment.
The analytic identifies instances where a service principal in Azure Active Directory assigns app roles without standard admin consent. This activity is detected by analyzing Entra ID logs from the `azure_monitor_aad` data source, specifically looking for "Add app role assignment to service principal" or "Add member to role*" operations initiated by a service principal. This detection is crucial for identifying potential bypasses of administrative consent processes, which could lead to unauthorized privilege grants. If malicious, this could allow attackers to exploit automation to assign sensitive permissions without proper oversight, compromising the security of the Azure AD environment.
The following analytic identifies attempts to delete AWS Bedrock Knowledge Bases, which are resources that store and manage domain-specific information for AI models. It monitors AWS CloudTrail logs for DeleteKnowledgeBase API calls. This activity could indicate an adversary attempting to remove knowledge bases after compromising credentials, potentially to disrupt business operations or remove traces of data access. Deleting knowledge bases could impact model performance, remove critical business context, or be part of a larger attack to degrade AI capabilities. If confirmed malicious, this could represent a deliberate attempt to cause service disruption or data loss.
The following analytic identifies the creation of AWS IAM access keys by a user for another user, which can indicate privilege escalation. It leverages AWS CloudTrail logs to detect instances where the user creating the access key is different from the user for whom the key is created. This activity is significant because unauthorized access key creation can allow attackers to establish persistence or exfiltrate data via AWS APIs. If confirmed malicious, this could lead to unauthorized access to AWS services, data exfiltration, and long-term persistence in the environment.
This analytic identifies the creation of new open/public GCP Storage buckets. It leverages GCP PubSub events, specifically monitoring for the `storage.setIamPermissions` method and checks if the `allUsers` member is added. This activity is significant because open storage buckets can expose sensitive data to the public, posing a severe security risk. If confirmed malicious, an attacker could access, modify, or delete data within the bucket, leading to data breaches and potential compliance violations.
Page 116 of 135