Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detects attempts to tamper with or disable AWS security monitoring controls, specifically GuardDuty detectors and AWS Config recording. Attackers frequently disable these services to evade detection after gaining administrative permissions in a cloud environment.
This rule detects the creation of compute resources (EC2 instances, launch templates, or spot instances) within AWS regions that are designated as dormant or rarely used. This behavior is a common indicator of regional 'region-hopping,' used by attackers for cryptojacking or establishing C2 infrastructure to evade detection, particularly in regions where monitoring and cost-based alerts are less mature.
Detects potential privilege escalation sequences in AWS where an identity uses 'iam:PassRole' in conjunction with resource-creation APIs (such as 'lambda:CreateFunction', 'ec2:RunInstances', or 'cloudformation:CreateStack'). This pattern is indicative of an attacker attempting to attach a higher-privileged role to a newly created resource under their control, allowing them to perform actions beyond their current scope.
Detects modifications to AWS Lambda functions that indicate potential backdooring, specifically unauthorized resource policy grants (lambda:InvokeFunction with a wildcard principal) or unexpected function code/configuration updates. This activity enables persistent, low-visibility execution by leveraging existing function permissions.
Detects modifications to AWS Lambda functions that indicate potential backdooring, specifically unauthorized resource policy grants (lambda:InvokeFunction with a wildcard principal) or unexpected function code/configuration updates. This activity enables persistent, low-visibility execution by leveraging existing function permissions.
Detects the creation or modification of credentials (access keys or login profiles) for the AWS root account or identities explicitly named to imply high-privilege administrative access. This is a high-fidelity indicator of persistence or unauthorized privilege escalation within an AWS environment.
Detects unauthorized cross-account copying of AWS EC2 or RDS snapshots, a key indicator of data exfiltration or staging as part of a snapshot-theft attack chain. The rule correlates copy events where the source snapshot owner is different from the destination account ID.
Detects the deletion of AWS CloudWatch log groups, log streams, metric filters, CloudWatch alarms, and VPC Flow Logs. Such actions are often indicative of an adversary attempting to destroy forensic evidence or disable security alerting prior to further unauthorized activity, such as data exfiltration or resource abuse.
Detects modifications to AWS CloudTrail event selectors that result in a loss of audit coverage (e.g., stopping management event logging or narrowing the ReadWriteType), which is a technique used by sophisticated actors to silently evade detection while keeping the trail status as enabled.
Detects the creation of an AWS IAM access key (CreateAccessKey) for the root account or identities with administrative naming conventions. This activity can indicate persistence establishment by an attacker who has gained high-privileged access, as new access keys provide a durable way to maintain programmatic control that bypasses standard session-based security controls.
Detects unauthorized attempts to stop CloudTrail logging or delete existing CloudTrail configurations within an AWS environment. Disabling logging is a significant indicator of defense evasion, often used by attackers to mask subsequent malicious activities such as data exfiltration, privilege escalation, or resource abuse.
Detects the creation of a new AWS IAM role with a trust policy that permits access from an external or wildcard principal, which is often used as a persistence mechanism to allow unauthorized cross-account access. The rule also triggers if an AdministratorAccess policy is attached to a newly created role, as these actions are commonly chained in cloud intrusions.
Detects AWS CloudTrail events where VPC Flow Logs are disabled or deleted, potentially indicating an adversary attempting to evade network monitoring by blinding detection mechanisms for lateral movement or data exfiltration.
Detects the deletion of Azure Monitor diagnostic settings or log profiles that export subscription-level Activity Logs. This action disables logging, effectively blinding security visibility into tenant operations, and is often used by adversaries as a defense-evasion technique before conducting further malicious activities.
Detects the attachment of the 'AdministratorAccess' managed policy or custom policies with wildcard actions and resources to AWS IAM users, roles, or groups. This activity is a critical indicator of privilege escalation, often serving as the final step in gaining full control of an AWS account by an adversary.
Detects unauthorized or suspicious modifications to AWS GuardDuty, including detector deletion, disabling of the service, disassociation from the master account, or the creation of suppression filters that archive findings, all of which indicate potential defense evasion by an adversary.
Detects the creation of a new AWS IAM policy version with 'SetAsDefault' enabled, specifically where the policy document contains overly permissive wildcard actions, resources, or full IAM administrative privileges. This technique allows an attacker to escalate privileges by modifying an existing policy version without updating the attachment status, effectively bypassing standard monitoring of policy attachments.
Detects the attachment of the 'AdministratorAccess' managed policy or custom policies with wildcard actions and resources to AWS IAM users, roles, or groups. This activity is a critical indicator of privilege escalation, often serving as the final step in gaining full control of an AWS account by an adversary.
This rule detects the use of browser-based cloud shells (AWS CloudShell, Azure Cloud Shell) as an entry point for post-exploitation activities, specifically tracking when these sessions are followed by object storage operations (S3 PutObject/GetObject or equivalent Azure Blob operations) within the same session context. This pattern is indicative of attackers using ephemeral cloud shells to stage stolen data or download offensive tooling, thereby bypassing host-based EDR monitoring.
Detects unauthorized attempts to delete CloudTrail log files or destroy the underlying storage bucket used for logs. This activity is a form of anti-forensics intended to remove evidence of malicious activity within the cloud control plane. The detection excludes legitimate automated S3 lifecycle management events.
Detects the creation of a new AWS IAM policy version with 'SetAsDefault' enabled, specifically where the policy document contains overly permissive wildcard actions, resources, or full IAM administrative privileges. This technique allows an attacker to escalate privileges by modifying an existing policy version without updating the attachment status, effectively bypassing standard monitoring of policy attachments.
Page 19 of 135