Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
This rule detects when a Google Cloud Workload Identity Pool is either disabled or deleted. Workload Identity Pools are used to manage external identities (e.g., from AWS, Azure, or on-premises identity providers) that need to access Google Cloud resources. Disabling or deleting a Workload Identity Pool will immediately revoke access for all federated identities associated with that pool, potentially leading to a denial of service for legitimate users or indicating an attempt by an attacker to disrupt operations or remove traces of their access. The rule specifically looks for the 'google.iam.v1.WorkloadIdentityPools.DeleteWorkloadIdentityPool' event or an 'google.iam.v1.WorkloadIdentityPools.UpdateWorkloadIdentityPool' event where the 'req_identityPool_disabled' attribute is set to 'true'.
This rule detects when a new service account key is either created within a monitored Google Cloud project or uploaded to it. This activity is significant because service account keys grant programmatic access to Google Cloud resources and can be used for persistence by adversaries if compromised or maliciously created.
Detects when an AWS Backup Plan or Backup Selection is deleted. This activity can indicate an adversary attempting to inhibit system recovery by removing backup configurations, potentially as a precursor to data destruction or encryption for impact.
Detects a successful attempt to retrieve the encrypted Administrator password for a Windows EC2 instance using the GetPasswordData API call in AWS CloudTrail. This action indicates an adversary is attempting to gain access to credentials for a Windows virtual machine.
Detects AWS IAM activities originating from an EC2 instance that could be used to retain access or escalate privileges. This includes actions like creating users, attaching policies, creating/updating login profiles, creating access keys, creating groups, and creating roles.
Detects attempts to disable multi-factor authentication for an AWS IAM user by monitoring AWS CloudTrail events for 'DeleteVirtualMFADevice' or 'DeactivateMFADevice' actions. This could indicate an adversary attempting to maintain persistent access or bypass MFA for compromised accounts.
Detects when the S3 Public Access Block configuration has been removed from an AWS S3 bucket or an entire AWS account. This action can significantly increase the risk of public exposure for S3 objects, potentially leading to data breaches or unauthorized access. The rule specifically looks for `DeleteAccountPublicAccessBlock`, `DeleteBucketPublicAccessBlock` events, or `PutBucketPublicAccessBlock`/`PutAccountPublicAccessBlock` events where all public access blocking attributes (`RestrictPublicBuckets`, `BlockPublicPolicy`, `BlockPublicAcls`, `IgnorePublicAcls`) are set to false or are missing, indicating a removal or weakening of the public access block.
Detects when AWS VPC Flow Logs are deleted. This action can be an attempt by an adversary to impair defenses by removing or modifying logging capabilities to avoid detection of their activities.
This rule detects potential lateral movement within an AWS environment where an IAM session token, obtained via `GetSessionToken`, is subsequently used from a different IP address than where it was initially requested. This behavior can indicate an attacker has compromised credentials and is attempting to use them from a new location.
This rule detects cryptocurrency mining activity within Amazon EC2, AWS Lambda, or Amazon EKS Runtimes, as reported by AWS GuardDuty. It specifically looks for GuardDuty findings related to 'CryptoCurrency', 'CryptoMinerExecuted', or 'BitcoinDomainRequest' and filters out sample findings.
Detects when an AWS GuardDuty detector is disabled or suspended. This can indicate an adversary attempting to impair defenses to avoid detection.
This rule detects a specific privilege escalation scenario in AWS where a user creates a new access key for another user and then immediately uses that newly created access key from the same IP address to perform further actions. This behavior indicates an attempt to escalate privileges by leveraging a newly generated credential.
This rule detects when a GuardDuty Detector's publishing destination has been deleted. GuardDuty is an AWS threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect AWS accounts and workloads. Deleting its publishing destination prevents GuardDuty from exporting its findings, effectively impairing the organization's ability to detect and respond to security incidents. This action could be performed by an attacker attempting to hide their activities or by an insider aiming to reduce security visibility.
This rule detects AWS IAM activities associated with the S3 Browser utility. Specifically, it looks for attempts to create new users (`CreateUser`), create login profiles (`CreateLoginProfile`), create access keys (`CreateAccessKey`), or put user policies (`PutUserPolicy`) within AWS IAM. The detection is triggered when these actions are performed and the HTTP user agent string in the CloudTrail log indicates the use of 'S3 Browser'. This combination of actions and user agent suggests potential account manipulation for persistence or privilege escalation within an AWS environment.
This rule detects when AWS API Gateway keys are accessed with the 'includeValue' or 'includeValues' parameter set to 'true'. This indicates an attempt to retrieve the actual API key values, which could be a credential access attempt. The rule specifically looks for 'GetApiKey' and 'GetApiKeys' events in AWS CloudTrail logs where the request explicitly asks for the key's value.
Detects when an AWS CloudFront distribution is created or updated with an insecure SSL policy, specifically allowing TLSv1, SSLv3, TLSv1_2016, or TLSv1.1_2016. These protocols are considered insecure and can expose data to various attacks.
This rule detects when an EC2 instance makes a high number of API calls within a 5-minute window. The rule specifically looks for API calls originating from an assumed role associated with an EC2 instance, identified by a user ID matching the pattern `/i-.*$/`. A high number is defined as more than 7 distinct product event types within the specified timeframe. This behavior can indicate reconnaissance or other malicious activity from a compromised instance.
This rule detects when an Amazon RDS Snapshot is shared publicly. This action can lead to sensitive data exposure if the snapshot contains confidential information. The detection is based on AWS CloudTrail logs, specifically looking for 'ModifyDBSnapshotAttribute' or 'ModifyDBClusterSnapshotAttribute' events where the 'Request Parameters Values To Add' includes 'all' and 'Request Parameters Attribute Name' is 'restore'. This indicates an attempt to make the snapshot publicly restorable.
This rule detects when a Google Cloud Storage bucket's access policy is modified to allow public access. This occurs when 'allUsers' or 'allAuthenticatedUsers' are added to the bucket's permissions, granting broad access to its contents. Such a configuration can lead to unintended data exposure and is a significant security risk.
Detects when an AWS Key Management Service (KMS) key is disabled or scheduled for deletion. This activity can indicate an attempt to disrupt services, destroy data, or hinder forensic analysis by making encrypted data inaccessible.
This rule detects the usage of a Google Cloud Platform (GCP) service account key from more than two distinct countries within a one-hour period. It leverages GeoIP enrichment data from Chronicle to identify the geographical origin of the IP addresses making the API calls. This behavior can indicate a compromised service account key being used by an attacker from multiple locations, potentially to evade detection or perform malicious activities across different regions.
Page 126 of 135