Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detect when an IAM session token is created and used from a different IP.
Detects attempts to disable multi-factor authentication for an AWS IAM user.
Detects the registration of a new Multi Factor authentication method for an AWS user.
Detects when an existing password policy is updated or deleted in an AWS account.
Detect when a user creates a new access key for another user and escalates privileges using this newly created access key from the same IP.
Detect when a user creates or updates a login profile for another user and escalates privileges using this new user from the same IP.
Detect when an AWS S3 bucket is made public using ACL.
Detect when the S3 Public Access Block configuration has been removed from a bucket or an account.
Detect when an AWS security group is opened to the world (0.0.0.0/0) or (::/0)
Detects successful API executions from a Tor exit node.
Detects when an AWS user successfully authenticating from more than one unique IP address within 5 minutes.
Detects when an AWS IAM user creates an AWS Access Key for programmatic calls.
Detect when multiple secrets or secret versions are deleted from GCP Secret Manager.
Detect when multiple GCP Service APIs are disabled in a short period of time.
Detects a successful attempt to retrieve the service API Keys.
Detects successful API executions from a Tor exit node.
Application creation is a legitimate activity but doesn't occur frequently. Alerts when a new application is created in Entra ID (formerly Azure AD).
Detects when a user creates a Lambda function URL configuration, which could be used to expose the function to the internet and potentially allow unauthorized access to the function's IAM role for AWS API calls.
This could give an adversary access to the privileges associated with the Lambda service role that is attached to that function.
This could give an adversary access to the privileges associated with the Lambda service role that is attached to that function.
Detects modifications to an AWS RDS cluster or its deletion, which may indicate potential data exfiltration attempts, unauthorized access, or exposure of sensitive information. These actions can be performed by an attacker to disrupt services, remove evidence, or facilitate data theft.
Detects when an access policy that is applied to a GCP cloud resource is deleted. An adversary would be able to remove access policies to gain access to a GCP cloud resource.
Detects modifications to an RDS cluster or its deletion, which may indicate potential data exfiltration attempts, unauthorized access, or exposure of sensitive information.
Page 130 of 135