Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
157 detections
Filters
Last updated
All Time
Detection languages
69
30
19
19
13
Contributors
44
28
19
10
10
Categories
20,402
11,796
5,865
5,145
4,864
Platforms
61
44
43
32
26
Products / Services
56
38
28
23
12
MITRE Techniques
59
42
41
40
34
IDS Classtypes
3
IDS Protocols
3
Identifies when a Google Workspace user transfers the ownership of a file.
Detect when an AWS S3 bucket is made public using ACL.
Detects when AWS S3 bucket versioning is disabled. This action can be a precursor to data deletion or modification without the ability to recover previous versions, often seen in ransomware attacks targeting cloud storage.
Detects when S3 bucket versioning is disabled. Threat actors use this technique during AWS ransomware incidents prior to deleting S3 objects.
Detects when Microsoft Cloud App Security reports an unusual volume of file deletions by a user, which could indicate malicious activity such as data destruction or ransomware.
Detects when a Google Cloud Storage bucket is modified or deleted. This includes operations such as deleting a bucket, inserting (creating) a bucket, or updating/patching a bucket's properties. Such activities can indicate unauthorized access, data manipulation, or attempts to disrupt services.
This rule detects when a user or entity makes changes to Amazon S3 bucket data management configurations. This includes modifications to logging, website hosting, encryption, lifecycle policies, replication configurations, and object restoration. Such changes could indicate an attempt to tamper with data integrity, availability, or exfiltration mechanisms within S3.
Detects when an AWS EFS Fileshare is deleted. This action can indicate an attempt to disrupt availability or destroy data. Adversaries might delete file systems to impact operations or cover their tracks. Note that an EFS file system cannot be deleted if it has active mount targets, implying that mount targets would need to be deleted first.
Detects when storage bucket is modified or deleted in Google Cloud.
Detects when a user tampers with S3 data management in Amazon Web Services.
Page 8 of 8