Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
157 detections
Filters
Last updated
All Time
Detection languages
69
30
19
19
13
Contributors
44
28
19
10
10
Categories
20,402
11,796
5,865
5,145
4,864
Platforms
61
44
43
32
26
Products / Services
56
38
28
23
12
MITRE Techniques
59
42
41
40
34
IDS Classtypes
3
IDS Protocols
3
This rule detects successful configuration modifications to diagnostic settings or storage services where the destination resource is identified as being outside of the organization's trusted subscriptions or expected storage naming conventions. This activity may indicate an adversary attempting to exfiltrate logs or data to an attacker-controlled storage account.
Detects the deletion of immutability policies on Azure blob containers. Immutability policies protect critical data from being tampered with; their deletion is a necessary step for attackers aiming to encrypt or destroy backups and storage data prior to a ransomware event.
Detects the creation of an encryption scope within an Azure Storage account. Attackers may use this to encrypt victim blobs with their own keys, as observed with threat actors like STORM-0501, to demand ransom.
Detects suspicious repository content updates, such as modifications to package files, workflow configurations, or README files, and activities involving automated user IDs like 'dependabot' or 'github-actions' that may indicate compromised CI/CD credentials or unauthorized repository defacement.
Detects high-frequency S3 PutObject requests that utilize Customer-Provided Encryption Keys (SSE-C). A high count of such operations within a short window can be indicative of ransomware activity, where an adversary encrypts data within the victim's cloud storage using their own keys to prevent access by the owner.
Detects S3 bucket lifecycle policies configured for automatic object deletion
This rule detects suspicious activities related to AWS S3 buckets that could indicate a bucket hijacking attempt or unauthorized replication to an external account. Specifically, it looks for two scenarios: 1) an S3 bucket being deleted and then recreated by a different AWS account within a one-hour window, suggesting a namespace hijacking, or 2) an S3 bucket being deleted while a PutBucketReplication event references an external AWS account, indicating an attempt to exfiltrate data or maintain access through replication.
Detects rapid deletion and recreation of cloud storage buckets (S3 or Azure Storage) within a short timeframe (60 seconds). This behavior is often indicative of an attempt to hijack a bucket name or gain unauthorized access to data by exploiting race conditions or misconfigurations in infrastructure management.
Detects a high volume of file uploads (greater than 50) to OneDrive or SharePoint by a single user within a 5-minute window, potentially indicating bulk exfiltration of data.
Detects a sequence of events where a cloud storage bucket is deleted and then immediately recreated with the same name. This pattern is indicative of a potential bucket hijacking attack, where an adversary attempts to take ownership of a bucket to intercept data streams, such as logging sinks, application data, or replication traffic.
Detects broad assignments of administrative roles or specific deletion permissions for cloud storage buckets in GCP, AWS, and Azure. This includes granting 'storage.admin', 'storage.objectAdmin', or 'storage.buckets.delete' in GCP, 's3:DeleteBucket' in AWS IAM policies, or 'Storage Account Contributor'/'Owner' roles in Azure. Such assignments to service accounts or non-administrative identities could enable 'Universal Bucket Hijacking' or unauthorized data deletion.
Detects a potential S3 bucket hijacking attempt where a bucket is deleted by one AWS account and subsequently recreated by a different AWS account within a 30-minute window. This behavior could indicate an attempt to intercept cross-account replication or misdirected data flows.
Detects the modification of Azure Storage account management policies where the 'daysAfterModificationGreaterThan' condition is set to 7 days or less, specifically including a 'delete' action. This could indicate an attempt by an adversary to shorten the lifecycle of data for rapid, automated, and potentially malicious data destruction within Azure Blob Storage.
This rule detects successful configuration modifications to diagnostic settings or storage services where the destination resource is identified as being outside of the organization's trusted subscriptions or expected storage naming conventions. This activity may indicate an adversary attempting to exfiltrate logs or data to an attacker-controlled storage account.
Detects a sequence of events where a Google Cloud Storage bucket is deleted by a user, followed by the creation or modification of a Pub/Sub subscription referencing a Cloud Storage destination. This pattern is indicative of 'Universal Bucket Hijacking', where an attacker attempts to hijack a data stream by recreating a deleted bucket or reconfiguring a service to redirect traffic to an attacker-controlled destination.
Detects a potential logging sink hijack in Google Cloud Platform (GCP) by identifying the deletion of a logging sink's destination bucket followed by the creation of a new bucket with the same name in a different project. This technique could allow an attacker to redirect logs to an attacker-controlled bucket, impairing defenses and potentially exfiltrating sensitive log data.
Detects the creation or modification of Azure Storage Account management policies that include rules configured to delete blobs, snapshots, or versions in less than 30 days. This behavior may indicate an attempt at data destruction or unauthorized cleanup of cloud storage objects.
Detects the creation or modification of Azure Storage Account management policies that include rules configured to delete blobs, snapshots, or versions in less than 30 days. This behavior may indicate an attempt at data destruction or unauthorized cleanup of cloud storage objects.
Detects the modification of Azure Storage account management policies where the 'daysAfterModificationGreaterThan' condition is set to 7 days or less, specifically including a 'delete' action. This could indicate an attempt by an adversary to shorten the lifecycle of data for rapid, automated, and potentially malicious data destruction within Azure Blob Storage.
Detects the deletion of a storage bucket immediately followed by the creation of a new bucket with the same name across different cloud providers (GCP, AWS S3, Azure). This rule specifically flags scenarios where the deleting actor or project differs from the creating actor or project, indicating a potential cross-account hijack or data exfiltration attempt.
This rule detects a potential Azure storage account name hijacking scenario. It identifies instances where a storage account is deleted and then recreated with the exact same name in a different subscription within the same Azure tenant, all within a 60-minute window. This activity could indicate an attempt to exfiltrate data via Azure Monitor diagnostic settings by taking over a previously used storage account name.
Page 5 of 8