Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
150 detections
Filters
Last updated
All Time
Detection languages
85
24
19
13
5
Contributors
31
25
20
13
12
Categories
127
75
30
25
16
Platforms
51
41
31
27
25
Products / Services
37
34
27
19
13
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
5
1
IDS Classtypes
2
IDS Protocols
2
The following analytic identifies potential AWS S3 exfiltration behavior by correlating multiple risk events related to Collection and Exfiltration techniques. It leverages risk events from AWS sources, focusing on instances where two or more unique analytics and distinct MITRE ATT&CK IDs are triggered for a specific risk object. This activity is significant as it may indicate an ongoing data exfiltration attempt, which is critical for security teams to monitor. If confirmed malicious, this could lead to unauthorized access and theft of sensitive information, compromising the organization's data integrity and confidentiality.
The analytic detects when an EC2 snapshot is shared publicly by analyzing AWS CloudTrail events. This detection method leverages CloudTrail logs to identify modifications in snapshot permissions, specifically when the snapshot is shared outside the originating AWS account. This activity is significant as it may indicate an attempt to exfiltrate sensitive data stored in the snapshot. If confirmed malicious, an attacker could gain unauthorized access to the snapshot's data, potentially leading to data breaches or further exploitation of the compromised information.
The analytic detects suspicious modifications to AWS AMI attributes, such as sharing an AMI with another AWS account or making it publicly accessible. It leverages AWS CloudTrail logs to identify these changes by monitoring specific API calls. This activity is significant because adversaries can exploit these modifications to exfiltrate sensitive data stored in AWS resources. If confirmed malicious, this could lead to unauthorized access and potential data breaches, compromising the confidentiality and integrity of organizational information.
This rule detects the creation or modification of anonymous links in OneDrive. Anonymous links can be used to export files from OneDrive, posing a risk of data leakage, especially in organizations that do not support their creation.
Detects when a GitHub repository transfer is initiated. This event indicates that a user has started the process of transferring ownership of a repository to another user or organization. This could be a legitimate administrative action but also a precursor to data exfiltration or unauthorized access if performed maliciously.
This rule detects when a GitHub organization initiates an outgoing transfer to another enterprise account. This activity is suspicious because an adversary might attempt to transfer a GitHub organization to an enterprise account they control to steal data, intellectual property, or maintain persistence. The rule specifically looks for the `org.transfer_outgoing` event type in GitHub audit logs.
This rule detects multiple failed attempts (401 Unauthorized status) to download the same file from OneDrive via the Microsoft Graph API. This behavior may indicate a permissions issue for the user attempting the download or could be an indicator of an adversary attempting to access unauthorized files.
Detects when a GitHub organization is transferred to another enterprise account. An adversary may attempt to transfer a GitHub organization to an enterprise account they control in order to steal data.
Detects when a GitHub repository is transferred.
This rule detects when a Google Cloud Platform (GCP) Compute Engine image's access policy is modified to include 'allAuthenticatedUsers'. This action effectively makes the image publicly accessible to any authenticated Google user, which could lead to unauthorized access or data exfiltration if sensitive data is present in the image.
This rule detects when an Amazon RDS Snapshot is shared publicly. This action can lead to sensitive data exposure if the snapshot contains confidential information. The detection is based on AWS CloudTrail logs, specifically looking for 'ModifyDBSnapshotAttribute' or 'ModifyDBClusterSnapshotAttribute' events where the 'Request Parameters Values To Add' includes 'all' and 'Request Parameters Attribute Name' is 'restore'. This indicates an attempt to make the snapshot publicly restorable.
Detects when an Amazon EC2 AMI (Amazon Machine Image) or Snapshot is modified to be shared publicly. This action can lead to sensitive data exposure or provide adversaries with a way to exfiltrate data by sharing it with an 'all' group, making it accessible to anyone.
Detect when GCP Compute Image is opened to public by adding allAuthenticatedUsers to the access policy.
Detects when an Amazon RDS Snapshot is shared publicly.
Detects when an Amazon EC2 AMI or Snapshot is shared publicly.
Detects when Microsoft Cloud App Security reports that an OAuth application has downloaded multiple files from Microsoft SharePoint or Microsoft OneDrive in a manner that is unusual for the user. This activity could indicate unauthorized data exfiltration by a compromised or malicious OAuth app.
This rule detects when an AWS EC2 snapshot's permissions are modified to allow access from another AWS account. This activity can indicate an attempt to exfiltrate data stored in the snapshot by sharing it with an adversary-controlled account.
This rule detects attempts to export an AWS EC2 instance, specifically when the 'CreateInstanceExportTask' event is logged in AWS CloudTrail. This action can be an indicator of an adversary attempting to exfiltrate data from a compromised EC2 instance by exporting it as a virtual machine image. The rule specifically looks for successful export task creations, filtering out events that contain error messages or codes, or indicate a 'Failure' in the response elements.
This rule detects when a user or entity makes changes to Amazon S3 bucket data management configurations. This includes modifications to logging, website hosting, encryption, lifecycle policies, replication configurations, and object restoration. Such changes could indicate an attempt to tamper with data integrity, availability, or exfiltration mechanisms within S3.
Detects when Microsoft Cloud App Security identifies a user or IP address using an unsanctioned application to perform activities resembling data exfiltration from the organization. This rule specifically triggers on 'Data exfiltration to unsanctioned apps' events with a 'success' status from the SecurityComplianceCenter event source.
An attempt to export an AWS EC2 instance has been detected. A VM Export might indicate an attempt to extract information from an instance.
Page 7 of 8