Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
13 detections
Filters
Last updated
All Time
Detection languages
5
2
2
2
1
Contributors
4
4
2
2
1
Categories
10
5
3
3
2
Platforms
13
2
Products / Services
10
3
3
2
2
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
IDS Classtypes
2
IDS Protocols
2
The following analytic detects the creation of a cloud compute instance in a region that has not been previously used within the last hour. It leverages cloud infrastructure logs and compares the regions of newly created instances against a lookup file of historically used regions. This activity is significant because the creation of instances in new regions can indicate unauthorized or suspicious activity, such as an attacker attempting to evade detection or establish a foothold in a less monitored area. If confirmed malicious, this could lead to unauthorized resource usage, data exfiltration, or further compromise of the cloud environment.
Detects the provisioning of high-performance compute instances (GPU or high-CPU) in AWS regions that fall outside of an established organizational baseline. This behavior is often associated with unauthorized resource hijacking (cryptomining) by adversaries leveraging compromised IAM principals to deploy infrastructure in regions with lower visibility or monitoring coverage.
This rule detects the creation of compute resources (EC2 instances, launch templates, or spot instances) within AWS regions that are designated as dormant or rarely used. This behavior is a common indicator of regional 'region-hopping,' used by attackers for cryptojacking or establishing C2 infrastructure to evade detection, particularly in regions where monitoring and cost-based alerts are less mature.
Detects the launch of compute-optimized or GPU-accelerated EC2 instances via the RunInstances API. This behavior is a common indicator of unauthorized resource hijacking, such as cryptomining, where attackers leverage compromised credentials to deploy resource-intensive workloads in regions that have not been historically used by the organization.
Detects unexpected processes requesting AWS IMDSv2 tokens from the link-local address 169.254.169.254. This activity can indicate an attempt to steal temporary cloud credentials from compromised EC2 instances, as seen with malware like Miasma.
This rule detects HTTP POST requests to Amazon Web Services (AWS) endpoints that are associated with non-standard or less common cloud regions. Specifically, it looks for 'amazonaws.com' in the HTTP host and then checks the HTTP URI for region codes 'ap-east' (Asia Pacific - Hong Kong), 'me-south' (Middle East - Bahrain), or 'af-south' (Africa - Cape Town). The detection is triggered when a resource creation (indicated by HTTP POST) is attempted in one of these regions, which might be unusual for an organization primarily operating in other regions, potentially indicating unauthorized activity or misconfiguration.
This rule detects HTTP traffic where the host header contains specific cloud region identifiers that are considered rarely used. The rule is triggered if 10 such events occur within 60 seconds from the same source IP address. The identified regions are 'ap-east-1', 'me-south-1', 'af-south-1', and 'eu-south-1'. This could indicate an attempt to evade detection by using less common cloud infrastructure or an unauthorized API call from an unusual geographic location.
AWS Region Enablement Detection
Cortex XDR
Detects when a commonly abused or dormant/opt-in AWS region is enabled in an account. Adversaries may enable unused AWS regions to evade detection, deploy resources for malicious activities like cryptocurrency mining, or to establish persistence outside of actively monitored regions.
The analytic detects the creation of a cloud compute instance in a region that has not been previously used within the last hour. It leverages cloud infrastructure logs and compares the regions of newly created instances against a lookup file of historically used regions. This activity is significant because the creation of instances in new regions can indicate unauthorized or suspicious activity, such as an attacker attempting to evade detection or establish a foothold in a less monitored area. If confirmed malicious, this could lead to unauthorized resource usage, data exfiltration, or further compromise of the cloud environment.
The analytic identifies AWS console login attempts by users from a new region. It leverages AWS CloudTrail events and compares current login regions against a baseline of previously seen regions for each user. This activity is significant as it may indicate unauthorized access attempts or compromised credentials. If confirmed malicious, an attacker could gain unauthorized access to AWS resources, potentially leading to data breaches, resource manipulation, or further lateral movement within the cloud environment.
The analytic identifies AWS console login events by users from a new city within the last hour. It leverages AWS CloudTrail events and compares them against a lookup file of previously seen user locations. This activity is significant for a SOC as it may indicate unauthorized access or credential compromise, especially if the login originates from an unusual location. If confirmed malicious, this could lead to unauthorized access to AWS resources, data exfiltration, or further exploitation within the cloud environment.
This rule detects when an AWS region is enabled or disabled. Adversaries may enable new regions to create resources in an unmonitored environment or disable regions to disrupt services or evade detection. This activity is captured through AWS CloudTrail events for 'EnableRegion' or 'DisableRegion'.
Detects when an AWS region is enabled or disabled.