Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7 detections
Filters
Last updated
All Time
Detection languages
3
2
1
1
Contributors
2
2
1
1
1
Categories
3
3
2
2
1
Platforms
2
2
2
1
1
Products / Services
2
2
2
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
IDS Classtypes
2
IDS Protocols
2
Detects an AWS identity making 10 or more successful EC2 Instance ConnectSendSSHPublicKey API calls within the configured search interval.
EC2 Instance Connect temporarily makes an SSH public key available to an operating-system user on an EC2 instance.
A burst of these calls may indicate automated attempts to establish access or move laterally using compromised AWS credentials.
EC2 Instance Connect temporarily makes an SSH public key available to an operating-system user on an EC2 instance.
A burst of these calls may indicate automated attempts to establish access or move laterally using compromised AWS credentials.
This rule detects the presence of KVM-over-IP devices and spoofed USB peripherals, which are commonly associated with illicit remote access, particularly by DPRK IT workers.
This rule detects direct SSH connections to cloud virtual machines (VMs) via a serial console interface. It specifically looks for HTTP traffic where the host header contains 'compute.googleapis.com' or 'cloudshell.googleapis.com' and the URI contains 'serialPort'. This indicates an attempt to establish an SSH session through the cloud provider's serial console service, which can be used for administrative access or lateral movement within a cloud environment.
This rule detects HTTP POST requests to 'management.azure.com' with a URI containing 'bastionHosts'. This pattern indicates an attempt to establish a direct VM connection via Azure Bastion, which could be used for lateral movement within an Azure environment.
Matches published GRIMBOLT/SLAYSTYLE/BRICKSTORM hashes from RecoverPoint VM intrusions.
'This detection identifies high-severity alerts across various Microsoft security products, including Microsoft Defender XDR and Microsoft Entra ID, and correlates them with instances of Google Cloud VM creation. It focuses on instances where VMs were created within a short timeframe of high-severity alerts, potentially indicating suspicious activity.'
Get all filtering events done by the Windows filtering platform.
This includes any blocks done by Windows Firewall rules, but also blocks triggered by some 3rd party firewalls.
When no Firewall rules are configured, the default behavior is to block all incoming network connections.
This includes any blocks done by Windows Firewall rules, but also blocks triggered by some 3rd party firewalls.
When no Firewall rules are configured, the default behavior is to block all incoming network connections.