Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
This rule detects successful API executions within Google Cloud Platform (GCP) that originate from an IP address identified as a Tor exit node. It correlates GCP Cloud Audit logs, specifically looking for 'ALLOW' actions, with a GCTI (Google Cloud Threat Intelligence) feed that lists known Tor exit node IP addresses. The rule also calculates a risk score, with additional weight given if the originating IP is from certain high-risk countries (Cuba, Iran, North Korea, Russia, Syria).
Detects when an AWS Application Load Balancer (ALB) listener is created or modified to use an insecure SSL policy. Insecure SSL policies can expose communication to vulnerabilities such as weak ciphers or outdated TLS versions, potentially allowing attackers to decrypt sensitive data or perform downgrade attacks. The rule specifically looks for the use of several known insecure or deprecated ELBSecurityPolicy versions during 'ModifyListener' or 'CreateListener' CloudTrail events.
This rule detects when an AWS region is enabled or disabled. Adversaries may enable new regions to create resources in an unmonitored environment or disable regions to disrupt services or evade detection. This activity is captured through AWS CloudTrail events for 'EnableRegion' or 'DisableRegion'.
Detects when a user creates or updates a login profile for another user in AWS IAM and then the newly created/modified user logs in from the same IP address. This behavior can indicate privilege escalation where an attacker gains access to an existing user's credentials, creates a new login profile or modifies an existing one for another user, and then uses that new profile to log in, potentially escalating their privileges or maintaining persistence.
Detects a successful attempt to retrieve service API Keys within Google Cloud Platform. This activity could indicate an attacker attempting to gain access to sensitive credentials for further malicious actions.
Detects when an Amazon EC2 AMI (Amazon Machine Image) or Snapshot is modified to be shared publicly. This action can lead to sensitive data exposure or provide adversaries with a way to exfiltrate data by sharing it with an 'all' group, making it accessible to anyone.
This rule detects when Security Command Center services are disabled in Google Cloud Platform (GCP). Disabling Security Command Center can impair an organization's ability to detect security threats and vulnerabilities, making it a critical security event. The rule specifically looks for 'RESOURCE_WRITTEN' events in GCP Cloud Audit logs where the product event type indicates an update to Security Command Center settings, the target application is 'securitycenter.googleapis.com', and the 'service_enablement_state' label is set to 'DISABLED'.
Detects when an AWS GuardDuty Detector's trusted IP lists or threat intelligence IP lists are deleted or disabled. This activity could indicate an adversary attempting to impair defensive capabilities to avoid detection.
This rule detects administrative actions related to AWS SAML Identity Providers. Specifically, it triggers when a SAML provider is created, updated, or deleted within an AWS environment. Monitoring these events is crucial as SAML providers are used for federated access, and unauthorized changes could indicate attempts at persistence, privilege escalation, or defense evasion by manipulating authentication mechanisms.
This rule detects activity associated with the Tor network within an AWS account, as identified by AWS GuardDuty. It specifically looks for GuardDuty findings related to TorIPCaller, TorRelay, or TorClient, indicating potential use of Tor for anonymization or command and control.
This rule detects when the AWS IAM AdministratorAccess policy is attached to a user, group, or role. This action grants full administrative privileges and can be used by an attacker for privilege escalation, persistence, or to establish initial access within an AWS environment. The rule specifically looks for CloudTrail events indicating policy attachment actions (AttachUserPolicy, AttachGroupPolicy, AttachRolePolicy) where the target resource is the predefined 'AdministratorAccess' policy and the action was allowed.
Detects when an Amazon Simple Email Service (SES) configuration is modified, which could indicate an attacker attempting to propagate phishing email campaigns. This includes the creation, deletion, or verification of email identities and domains, as well as enabling sending for accounts or configuration sets.
This rule detects when an AWS security group ingress rule is modified to allow traffic from any IP address (0.0.0.0/0 for IPv4 or ::/0 for IPv6). This action, captured via AWS CloudTrail's AuthorizeSecurityGroupIngress event, significantly increases the attack surface of associated resources by making them accessible from the entire internet.
Detects excessive PermissionDenied events within an hour timeframe from a user
Identifies when a Google Workspace user downloads a file from Google Drive after a suspicious login event occurred.
Detect when GCP Cloud Audit logs are removed from all services at project or organization level. Audit logging helps organizations maintain security and minimize risk.
Detect when multiple HMAC authentication keys are deleted from GCP Storage settings.
Detects usage of service account key from multiple countries using Chronicle GeoIP enrichment.
Detects when a service account key is created in or uploaded to a monitored Google Cloud project.
Detects when an AWS region is enabled or disabled.
Detect when GCP Compute Image is opened to public by adding allAuthenticatedUsers to the access policy.
Page 127 of 135