Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
157 detections
Filters
Last updated
All Time
Detection languages
69
30
19
19
13
Contributors
44
28
19
10
10
Categories
20,425
11,812
5,870
5,145
4,864
Platforms
61
44
43
32
26
Products / Services
56
38
28
23
12
MITRE Techniques
59
42
41
40
34
IDS Classtypes
3
IDS Protocols
3
This rule detects administrative changes to cloud storage configurations (AWS S3, Azure Blob, and GCP Storage) that result in public or anonymous read/write access to buckets or containers, which could lead to unauthorized data exposure.
Detects modifications to cloud storage configurations in Azure and GCP that grant public access to containers or blobs. Attackers may leverage this to expose sensitive data stored in cloud environments by changing permissions to be publicly readable.
Detects unauthorized attempts to modify or delete AWS CloudTrail logs stored in S3, or changes to the S3 bucket lifecycle configuration that would shorten the log retention period. This activity is indicative of an adversary attempting to clear their tracks or hinder audit capabilities.
Detects unauthorized or risky configuration changes in Google Cloud Storage or Azure Storage accounts that grant public access (e.g., allUsers/allAuthenticatedUsers or public blob access) specifically on storage resources identified as production or sensitive (PII/financial data).
Detects potential abuse of Azure Cloud Shell backing storage (acsCloudShell) to stage or persist malicious scripts following an Azure AD session compromise. Adversaries may use this storage to blend in with legitimate engineering operations while maintaining persistent access to their tooling.
Detects anomalous, high-volume file deletion, modification, or resource deletion operations performed by an identified AI agent service account within a short timeframe. This behavior is indicative of a compromised AI agent being leveraged for mass data destruction, ransomware activity, or disruptive configuration changes.
Detects patterns associated with the TeamFiltration backdoor module, specifically unauthorized OneDrive/SharePoint file modifications occurring shortly after an authentication from a previously unseen device/IP. The rule flags file changes (modifications, deletions, or renames) involving potential executable or script extensions, or those performed by the OneDrive SyncEngine app from a new source.
Detects modifications to AWS S3 bucket policies, ACLs, or public access block settings that result in a bucket becoming publicly accessible. Attackers often leverage s3:PutBucketPolicy or similar permissions to make buckets public, allowing data exfiltration via anonymous HTTP requests and bypassing egress monitoring for direct API calls.
Detects Azure Activity Log events where a Storage Account is modified to enable public network access, public blob access, or container-level public access. Such misconfigurations can lead to unauthorized data exposure and exfiltration by internet-based actors.
Detects modifications to AWS S3 bucket policies, access control lists (ACLs), or public access block configurations that result in public bucket exposure. The rule specifically flags broad permissions such as 'AllUsers' or wildcard principal entities, and correlates these findings with AWS Config or Access Analyzer data to confirm public reachability.
Detects changes to AWS S3 bucket policies or Access Control Lists (ACLs) that result in the bucket becoming publicly accessible. This is a common indicator of misconfiguration or unauthorized modification potentially leading to unauthorized data exposure.
Detects modifications to Google Cloud Storage bucket IAM policies that grant access to 'allUsers' or 'allAuthenticatedUsers'. This activity indicates a potential misconfiguration or an attempt by an attacker to stage or exfiltrate data by making bucket contents publicly accessible.
Detects malicious attempts to delete or modify the access control settings of centralized cloud audit log storage, such as S3 buckets, Azure Log Analytics workspaces, or GCP log buckets. These actions aim to impair visibility into an adversary's activities, a common step in anti-forensics and data destruction workflows.
This rule detects administrative changes to cloud storage configurations (AWS S3, Azure Blob, and GCP Storage) that result in public or anonymous read/write access to buckets or containers, which could lead to unauthorized data exposure.
Detects unauthorized attempts to delete CloudTrail log files or destroy the underlying storage bucket used for logs. This activity is a form of anti-forensics intended to remove evidence of malicious activity within the cloud control plane. The detection excludes legitimate automated S3 lifecycle management events.
Detects unauthorized attempts to delete CloudTrail log files or destroy the underlying storage bucket used for logs. This activity is a form of anti-forensics intended to remove evidence of malicious activity within the cloud control plane. The detection excludes legitimate automated S3 lifecycle management events.
Detects modifications to AWS S3 bucket policies, ACLs, or public access block settings that result in the bucket becoming publicly accessible. This covers PutBucketPolicy actions with wide-open principals, PutBucketAcl actions granting access to global groups (AllUsers or AuthenticatedUsers), and disabling the 'Block Public Access' feature.
Detects modifications to EBS snapshot attributes via ModifySnapshotAttribute where the snapshot is made publicly accessible (all group) or shared with an unauthorized AWS account ID, potentially indicating unauthorized exfiltration of disk contents.
Detects potential ransomware activity in AWS by identifying high volumes of S3 object encryption (using SSE-C or KMS) followed by the disabling or scheduled deletion of the associated KMS key material. This behavior aims to render data inaccessible to legitimate users while ensuring recovery is inhibited by destroying the cryptographic keys required for decryption.
Detects modifications to AWS S3 bucket permissions or public access block settings that result in publicly accessible buckets. The rule specifically monitors CloudTrail events such as PutBucketAcl, PutBucketPolicy, and PutPublicAccessBlock for configurations that permit AllUsers/AuthenticatedUsers access, overly permissive bucket policies with wildcard principals, or the deactivation of all four block-public-access settings.
Detects potential abuse of Azure Cloud Shell backing storage (acsCloudShell) to stage or persist malicious scripts following an Azure AD session compromise. Adversaries may use this storage to blend in with legitimate engineering operations while maintaining persistent access to their tooling.
Page 2 of 8