Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
16 detections
Filters
Last updated
All Time
Detection languages
10
2
2
1
1
Contributors
5
4
2
2
1
Categories
10
4
3
3
3
Platforms
8
5
4
3
3
Products / Services
5
3
3
2
2
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
2
IDS Protocols
2
Detects anomalous AWS Bedrock activity indicative of LLMjacking by correlating multiple phases of an attack chain (Model Enablement, Reconnaissance, Probing, and Execution) performed by a single identity within a short timeframe. This rule identifies attackers leveraging stolen IAM credentials to discover available AI models, probe for vulnerabilities, and execute unauthorized inference requests at scale.
Detects phishing attempts leveraging SendGrid infrastructure to send emails that impersonate well-known financial brands. The detection looks for emails with authentication checks passing (SPF/DKIM/DMARC) where the sender domain is suspicious (e.g., .asia or .com not matching the brand) and the volume of such messages suggests an automated campaign.
Detects phishing attempts leveraging SendGrid infrastructure to send emails that impersonate well-known financial brands. The detection looks for emails with authentication checks passing (SPF/DKIM/DMARC) where the sender domain is suspicious (e.g., .asia or .com not matching the brand) and the volume of such messages suggests an automated campaign.
Detects phishing attempts leveraging SendGrid infrastructure to send emails that impersonate well-known financial brands. The detection looks for emails with authentication checks passing (SPF/DKIM/DMARC) where the sender domain is suspicious (e.g., .asia or .com not matching the brand) and the volume of such messages suggests an automated campaign.
This detection identifies prompts with hostile or aggressive sentiment being sent to AWS Bedrock Claude models. Hostile prompts may indicate potential abuse, harassment, or other malicious intent.
Detects rapid deletion and recreation of cloud storage buckets (S3 or Azure Storage) within a short timeframe (60 seconds). This behavior is often indicative of an attempt to hijack a bucket name or gain unauthorized access to data by exploiting race conditions or misconfigurations in infrastructure management.
Detects cloud service hijacking for cryptocurrency mining workloads
Detects rapid deletion and recreation of cloud storage buckets (S3 or Azure Storage) within a short timeframe (60 seconds). This behavior is often indicative of an attempt to hijack a bucket name or gain unauthorized access to data by exploiting race conditions or misconfigurations in infrastructure management.
Detects a sequence of events where a cloud storage bucket is deleted and then immediately recreated with the same name. This pattern is indicative of a potential bucket hijacking attack, where an adversary attempts to take ownership of a bucket to intercept data streams, such as logging sinks, application data, or replication traffic.
Detects SMS pumping attacks via bulk SMS API requests
Detects unauthorized or external access attempts to exposed Ollama API endpoints (port 11434) for generating or chatting, which could be indicative of LLMjacking. The rule identifies requests from known attacker IPs or any external IP, especially if the request count is high.
This rule detects HTTP traffic indicating a potential cloud service compromise for cryptomining. Specifically, it looks for HTTP requests to 'ec2.amazonaws.com' with the URI containing 'RunInstances' and the client body containing 'p3' (case-insensitive). This combination suggests an attempt to provision EC2 instances, possibly for cryptomining, using a compromised AWS account.
This rule detects the launch of a GPU instance in Google Cloud Platform (GCP) by monitoring HTTP traffic. Specifically, it looks for HTTP requests to 'compute.googleapis.com' with the URI containing '/instances' and the client body containing 'acceleratorType' (case-insensitive). This combination suggests an attempt to provision a GPU-enabled virtual machine, which could be indicative of resource hijacking for purposes like cryptocurrency mining or other compute-intensive malicious activities.
This rule detects network communication with known AI model providers by checking `RemoteUrl` against a list of AI API URLs from an external CSV file. It aims to identify potential unauthorized use of AI services, data exfiltration to AI models, or to monitor AI usage within an environment.
Detects TruffleHog credential validation via sts:GetCallerIdentity - initial access indicator for AWS WorkMail phishing campaigns
KQL Query from file: Azure AI Security Finding Report
