Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
11 detections
Filters
Last updated
All Time
Detection languages
5
3
2
1
Contributors
2
2
2
2
1
Categories
7
5
2
2
2
Platforms
5
3
2
2
1
Products / Services
5
2
2
1
1
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
IDS Classtypes
2
IDS Protocols
2
Detects modifications to AWS Lambda functions that indicate potential backdooring, specifically unauthorized resource policy grants (lambda:InvokeFunction with a wildcard principal) or unexpected function code/configuration updates. This activity enables persistent, low-visibility execution by leveraging existing function permissions.
Detects modifications to AWS Lambda functions that indicate potential backdooring, specifically unauthorized resource policy grants (lambda:InvokeFunction with a wildcard principal) or unexpected function code/configuration updates. This activity enables persistent, low-visibility execution by leveraging existing function permissions.
This rule detects 'Push', 'Put', or 'PutManifest' operations on the 'mongo' repository using specific tags ('mongofr', 'latest'), which may indicate an attempt to overwrite or inject a malicious container image into a critical database registry.
Detects push operations to an Azure Container Registry. This activity is a common administrative task but can also indicate an adversary pushing a malicious, backdoored, or unauthorized container image into an environment, potentially for persistence or supply chain attack purposes.
This rule monitors for successful Azure Container Registry task write, run, or action operations that involve references to identity configurations, Azure KeyVault (vault.azure.net), or ACR task YAML files. These keywords are often associated with the configuration of managed identities or secret retrieval within the build process, which may indicate unauthorized task creation or manipulation to escalate privileges or exfiltrate secrets.
This rule detects the upload of virtual machine disk images (VMDK, OVA, OVF, QCOW2, VHD) to cloud storage via HTTP PUT requests. The rule specifically looks for HTTP PUT methods, URIs ending with common VM image file extensions, and a minimum file size of 1MB, indicating a substantial file transfer. This activity could signify an attacker attempting to upload a backdoored or malicious VM image for persistence or to establish a foothold in a cloud environment.
This rule detects attempts to push potentially malicious container images to an internal registry. It specifically looks for HTTP POST requests to '/v2/' and '/blobs/uploads/' URIs, indicating an image layer upload, with a data size greater than 100KB. This behavior could be indicative of an attacker attempting to establish persistence or introduce malicious code into the container environment.
This detection identifies when Microsoft Teams applications send messages to groups / users in your organization's tenant. It utilizes the 'BotAddedToTeam' and 'AppInstalled' action types from CloudAppEvents to collect all Teams applications created in the specified timeframe and then joins on MessageEvents, matching events where SenderObjectId equals AppGuid.
This activity is significant as it may uncover unverified applications being added to teams channels and communicating with users in your tenant. Teams application security, compliance, and permissions can be reviewed in the Microsoft Teams Admin portal -
https://admin.teams.microsoft.com/policies/manage-apps/
This activity is significant as it may uncover unverified applications being added to teams channels and communicating with users in your tenant. Teams application security, compliance, and permissions can be reviewed in the Microsoft Teams Admin portal -
https://admin.teams.microsoft.com/policies/manage-apps/
The following analytic identifies IAM users attempting to update or modify AWS Lambda code via the AWS CLI. It leverages CloudTrail logs to detect successful `UpdateFunctionCode` events initiated by IAM users. This activity is significant as it may indicate an attempt to gain persistence, further access, or plant backdoors within your AWS environment. If confirmed malicious, an attacker could upload and execute malicious code automatically when the Lambda function is triggered, potentially compromising the integrity and security of your AWS infrastructure.
Detects when an AWS Elastic Container Service (ECS) Task Definition is created, described, or run, and its container definition includes a command that queries the AWS container credential endpoint. This activity can indicate an adversary attempting to establish persistence or escalate privileges by backdooring task definitions to extract credentials.
Detects when an Elastic Container Service (ECS) Task Definition includes a command to query the credential endpoint.
This can indicate a potential adversary adding a backdoor to establish persistence or escalate privileges.
This can indicate a potential adversary adding a backdoor to establish persistence or escalate privileges.