Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
295 detections
Filters
Last updated
All Time
Detection languages
159
38
32
29
17
Contributors
96
50
39
17
14
Categories
171
167
134
53
43
Platforms
129
123
96
46
27
Products / Services
144
37
31
29
19
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
CVEs
1
IDS Classtypes
4
IDS Protocols
4
Detects unauthorized or risky configuration changes in Google Cloud Storage or Azure Storage accounts that grant public access (e.g., allUsers/allAuthenticatedUsers or public blob access) specifically on storage resources identified as production or sensitive (PII/financial data).
Detects an account performing a mass download or synchronization of files from SharePoint or OneDrive within a 30-minute window, occurring within two hours of a medium or high-risk Azure AD sign-in event. This pattern is indicative of potential account takeover and subsequent data exfiltration by an adversary using harvested credentials.
Detects unauthorized sharing, copying, or exporting of EBS, disk, or database snapshots to external cloud accounts, subscriptions, or projects that are not present in the defined trusted allow-list for AWS, Azure, or GCP environments.
Detects modifications to AWS S3 bucket policies, ACLs, or public access block settings that result in a bucket becoming publicly accessible. Attackers often leverage s3:PutBucketPolicy or similar permissions to make buckets public, allowing data exfiltration via anonymous HTTP requests and bypassing egress monitoring for direct API calls.
Detects Azure Activity Log events where a Storage Account is modified to enable public network access, public blob access, or container-level public access. Such misconfigurations can lead to unauthorized data exposure and exfiltration by internet-based actors.
Detects modifications to AWS S3 bucket policies, access control lists (ACLs), or public access block configurations that result in public bucket exposure. The rule specifically flags broad permissions such as 'AllUsers' or wildcard principal entities, and correlates these findings with AWS Config or Access Analyzer data to confirm public reachability.
Detects changes to AWS S3 bucket policies or Access Control Lists (ACLs) that result in the bucket becoming publicly accessible. This is a common indicator of misconfiguration or unauthorized modification potentially leading to unauthorized data exposure.
Detects modifications to Google Cloud Storage bucket IAM policies that grant access to 'allUsers' or 'allAuthenticatedUsers'. This activity indicates a potential misconfiguration or an attempt by an attacker to stage or exfiltrate data by making bucket contents publicly accessible.
Detects an anomalous volume of file downloads from cloud storage platforms (SharePoint, OneDrive, Google Drive, Box) occurring within two hours of a high or medium risk sign-in event, including impossible travel or token replay scenarios. This pattern is indicative of potential data exfiltration by an actor using compromised credentials.
Detects a suspicious sequence of events where a host performs multiple reconnaissance-style probes (health checks, documentation, or OpenAPI definitions) followed within 10 minutes by access to sensitive artifact-related URLs on the same remote host. This pattern is indicative of an attacker profiling a target server for metadata and then proceeding to exfiltrate files or sensitive artifacts.
Detects anomalous AWS IAM and Secrets Manager API activity indicative of credential abuse following suspected exposure. The rule identifies suspicious patterns such as unauthorized enumeration of access keys, secret retrieval, and creation of new keys by non-service principals, reflecting activity associated with ShinyHunters-style operations where compromised credentials are abused.
Detects a burst of file access or download operations from SharePoint or OneDrive by a single user account within a short timeframe. This behavior is indicative of bulk data collection or exfiltration, often associated with post-credential-theft activity where an attacker stage and extract organizational data.
Detects anomalous access to AWS Bedrock Knowledge Bases, identifying a pattern of initial reconnaissance (enumerating bases and data sources) followed by high-volume querying (Retrieve/RetrieveAndGenerate). This sequence is indicative of an attacker attempting to map out backend storage configurations and subsequently exfiltrate indexed document content.
Detects automated mailbox monitoring (mailbox access cadence) followed by searches for sensitive finance-related keywords (e.g., invoice, payment, wire, ACH). This pattern is characteristic of a 'Box Monitor' or 'Inbox Monitor' actor, which maintains persistence via API polling to exfiltrate financial information from a compromised account.
Detects a single identity listing access keys for a high volume (20+) of Azure Storage Accounts within a 15-minute window. This behavior is indicative of credential harvesting, reconnaissance, or automated exfiltration attempts targeting storage resources.
This rule detects administrative changes to cloud storage configurations (AWS S3, Azure Blob, and GCP Storage) that result in public or anonymous read/write access to buckets or containers, which could lead to unauthorized data exposure.
Detects modifications to EBS or RDS snapshot permissions that grant access to the public 'all' group or an external AWS account ID. This activity is a common method for exfiltrating sensitive data via unauthorized cross-account sharing, bypassing standard VPC egress monitoring and DLP controls.
Detects modifications to RDS or Aurora snapshot attributes that grant public access ('all') or share the snapshot with an external AWS account ID. This activity indicates a potential data exfiltration attempt, as sharing a snapshot allows an external party to restore the database in their own environment, bypassing existing application-layer access controls.
Detects modifications to AWS S3 bucket policies, ACLs, or public access block settings that result in the bucket becoming publicly accessible. This covers PutBucketPolicy actions with wide-open principals, PutBucketAcl actions granting access to global groups (AllUsers or AuthenticatedUsers), and disabling the 'Block Public Access' feature.
Detects modifications to EBS snapshot attributes via ModifySnapshotAttribute where the snapshot is made publicly accessible (all group) or shared with an unauthorized AWS account ID, potentially indicating unauthorized exfiltration of disk contents.
Detects modifications to AWS S3 bucket permissions or public access block settings that result in publicly accessible buckets. The rule specifically monitors CloudTrail events such as PutBucketAcl, PutBucketPolicy, and PutPublicAccessBlock for configurations that permit AllUsers/AuthenticatedUsers access, overly permissive bucket policies with wildcard principals, or the deactivation of all four block-public-access settings.
Page 2 of 15