Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
867 detections
Filters
Last updated
All Time
Detection languages
333
198
127
108
69
Contributors
215
147
122
95
58
Categories
20,417
11,806
5,870
5,145
4,864
867
Platforms
326
269
122
95
90
Products / Services
204
196
168
111
93
MITRE Techniques
357
351
224
111
110
CVEs
5
2
1
1
1
IDS Classtypes
14
1
IDS Protocols
10
3
1
1
This rule identifies when the password policy configuration is changed within Google Workspace. Monitoring these changes is crucial for security teams to detect potential weakening of the organization's security posture, which could be exploited by adversaries to maintain or elevate access.
Detects when principals are exempted from GCP Cloud Audit logs at either the project or organization level. This action can significantly impair an organization's ability to monitor security events and maintain compliance, as audit logs are crucial for detecting malicious activity and ensuring accountability. The rule specifically looks for 'SetIamPolicy' events targeting 'cloudresourcemanager.googleapis.com' where audit log exemptions are added for 'allServices'.
Detects when the S3 Public Access Block configuration has been removed from an AWS S3 bucket or an entire AWS account. This action can significantly increase the risk of public exposure for S3 objects, potentially leading to data breaches or unauthorized access. The rule specifically looks for `DeleteAccountPublicAccessBlock`, `DeleteBucketPublicAccessBlock` events, or `PutBucketPublicAccessBlock`/`PutAccountPublicAccessBlock` events where all public access blocking attributes (`RestrictPublicBuckets`, `BlockPublicPolicy`, `BlockPublicAcls`, `IgnorePublicAcls`) are set to false or are missing, indicating a removal or weakening of the public access block.
Detects when an existing password policy is updated or deleted in an AWS account. This could indicate an adversary attempting to weaken password requirements to facilitate brute-force attacks or to remove obstacles for credential reuse.
This rule detects when a Google Cloud Storage bucket's access policy is modified to allow public access. This occurs when 'allUsers' or 'allAuthenticatedUsers' are added to the bucket's permissions, granting broad access to its contents. Such a configuration can lead to unintended data exposure and is a significant security risk.
This rule detects when the AWS IAM AdministratorAccess policy is attached to a user, group, or role. This action grants full administrative privileges and can be used by an attacker for privilege escalation, persistence, or to establish initial access within an AWS environment. The rule specifically looks for CloudTrail events indicating policy attachment actions (AttachUserPolicy, AttachGroupPolicy, AttachRolePolicy) where the target resource is the predefined 'AdministratorAccess' policy and the action was allowed.
This rule detects when an AWS security group ingress rule is modified to allow traffic from any IP address (0.0.0.0/0 for IPv4 or ::/0 for IPv6). This action, captured via AWS CloudTrail's AuthorizeSecurityGroupIngress event, significantly increases the attack surface of associated resources by making them accessible from the entire internet.
Detect when GCP Cloud Audit logs are removed from all services at project or organization level. Audit logging helps organizations maintain security and minimize risk.
Identifies when Google Workspace password policy is changed. Security teams can monitor for changes to password policy configuration that may weaken the organization's security posture.
Detects when an AWS region is enabled or disabled.
Detects when a GuardDuty Detector's trusted or threat intel IP lists are deleted or disabled.
Detect when free Google Email addressess are added to IAM Policy such as gmail.com, googlemail.com or googlegroups.com.
Detects when a user removes an authentication factor or otp device.
Detects when CloudTrail logging is updated, stopped or deleted.
Detect when the AWS managed policy AWSCompromisedKeyQuarantine has been attached to a user, role, or group. It is applied by the AWS team in the event that the credentials of an IAM user has been compromised or publicly exposed.
Detect when admin privileged roles such as Owner or Editor are added to a Service Account.
Detect when GCP Cloud Audit logs are exempted for principals in all services at project or organization level. Audit logging helps organizations maintain security and minimize risk.
Detect when GCP IAM Organization Policy is updated or deleted.
Detect when GCP Security Command Center services are disabled.
Detects when an insecure SSL policy is configured for an AWS Application Load Balancer.
Detects when an insecure SSL policy is configured for an AWS CloudFront distribution.
Page 40 of 42