Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
158 detections
Filters
Last updated
All Time
Detection languages
86
29
20
11
4
Contributors
36
20
17
16
15
Categories
128
67
12
11
11
Platforms
106
46
35
27
10
Products / Services
57
39
28
19
16
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
3
IDS Classtypes
1
IDS Protocols
1
Detects a sequence of AWS API calls where an external IP first calls sts:GetCallerIdentity, followed by Bedrock model listing APIs, and subsequently IAM or account/trail discovery events within a short timeframe, indicating potential cloud reconnaissance or unauthorized access.
Detects a sequence where an assumed-role credential from an external IP calls sts:GetCallerIdentity followed by listing Amazon Bedrock foundation models within a one-hour window, potentially indicating reconnaissance of AI/ML services by an external threat actor.
The following analytic detects cloud API calls executed by user roles that have not previously run these commands. It leverages the Change data model in Splunk to identify commands executed by users with the user_type of AssumedRole and a status of success. This activity is significant because new commands from different user roles can indicate potential malicious activity or unauthorized actions. If confirmed malicious, this behavior could lead to unauthorized access, data breaches, or other damaging outcomes by exploiting new or unmonitored commands within the cloud environment.
This rule detects potentially malicious reconnaissance or enumeration activity by tracking high volumes of read-only API calls (LIST/read operations) across multiple Azure resource providers (e.g., VMs, Subscriptions, Web sites, Storage, Recovery Services) performed by a single identity within a 30-minute window.
Detects anomalous, high-volume enumeration activity (List/Get/Read operations) performed by a single identity across multiple Azure resource providers within a short time window, indicative of automated reconnaissance by a compromised service principal or managed identity.
Detects the use of open-source secret-scanning tools (e.g., TruffleHog) by identifying their specific User-Agent strings in AWS CloudTrail logs during GetCallerIdentity calls, followed by suspicious enumeration activity (ListBuckets, ListSecrets, ListAccessKeys) from the same source IP. This behavior is indicative of threat actors validating stolen credentials for unauthorized access to cloud resources.
Detects anomalous bursts of sts:GetCallerIdentity API calls, which are often used by adversaries to validate harvested or stolen AWS access keys. The rule monitors for a high frequency of such calls or a large number of distinct access keys being validated from IP addresses that are not part of the organization's approved corporate or cloud egress ranges.
Detects unauthorized attempts to disable, suppress, or modify security monitoring services in AWS, including GuardDuty, Security Hub, and AWS Config. This rule monitors for API calls that effectively reduce cloud visibility or detection capabilities, explicitly excluding actions performed by authorized security-engineering roles.
Detects high-volume, broad enumeration of sensitive Microsoft Graph API endpoints (users, groups, directory objects, applications, and mail folders) from a single host or user. This behavior is indicative of automated reconnaissance or post-compromise discovery of cloud identity environments.
Detects anomalous, high-velocity enumeration of IAM entities and cloud infrastructure resources by a single principal within a 5-minute window. This behavior is consistent with automated reconnaissance performed by agentic AI or scripted tools, often used to map cloud environments prior to exploitation.
This rule detects potential cloud service enumeration activity originating from a specific, potentially malicious IP address (23.234.84.102). It flags instances where this source IP performs specific API calls ('GetCallerIdentity' and 'ListTopics') without expected user-agent strings typical of legitimate AWS service traffic.
This rule detects potentially malicious reconnaissance or enumeration activity by tracking high volumes of read-only API calls (LIST/read operations) across multiple Azure resource providers (e.g., VMs, Subscriptions, Web sites, Storage, Recovery Services) performed by a single identity within a 30-minute window.
Detects multiple AWS API calls (Publish, GetCallerIdentity, ListTopics) originating from a specific IP address (23.234.84.102) associated with a Zapier SNS sender. This rule monitors for potentially unauthorized or anomalous API usage patterns by identifying repeated, successful, and non-error events from a known source that may indicate misuse or compromise of an integration account.
Detects high-volume, automated enumeration of cloud resources (SharePoint, OneDrive, or Exchange) via Graph API or search queries immediately following a user sign-in event. This behavior is indicative of session hijacking (token replay) followed by unauthorized scripted discovery, as opposed to legitimate user browsing activity.
Detects anomalous, high-velocity enumeration of IAM entities and cloud infrastructure resources by a single principal within a 5-minute window. This behavior is consistent with automated reconnaissance performed by agentic AI or scripted tools, often used to map cloud environments prior to exploitation.
This rule detects potentially malicious Microsoft Graph API activity, such as the enumeration of directory roles, groups, applications, or service principals. It identifies patterns indicative of token theft or unauthorized access by flagging scripted clients (non-browser agents) or accounts showing anomalous behavior (multiple IPs/agents) performing rapid or repetitive enumeration queries.
Detects anomalous, high-velocity enumeration of IAM entities and cloud infrastructure resources by a single principal within a 5-minute window. This behavior is consistent with automated reconnaissance performed by agentic AI or scripted tools, often used to map cloud environments prior to exploitation.
This rule detects potential cloud service enumeration activity originating from a specific, potentially malicious IP address (23.234.84.102). It flags instances where this source IP performs specific API calls ('GetCallerIdentity' and 'ListTopics') without expected user-agent strings typical of legitimate AWS service traffic.
Detects high-volume or sequential Microsoft Graph API requests targeting sensitive directory, mailbox, application, and site endpoints. This behavior is consistent with reconnaissance activity where an adversary enumerates users, groups, service principals, and accessible resources within a compromised cloud tenant.
Detects high-frequency, diverse access patterns against the Microsoft Graph API, indicative of automated enumeration or discovery of SharePoint, OneDrive, or search resources. The rule monitors for distinct paths (e.g., sites, drives, children) requested by a single actor within a 20-minute window.
Detects high-frequency access to multiple sensitive Microsoft Graph API paths (users, groups, applications, directoryRoles, servicePrincipals, etc.) from a single identity within a short timeframe. This pattern is indicative of automated reconnaissance or enumeration of the cloud environment's identity and application landscape.
Page 1 of 8