Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
34 detections
Filters
Last updated
All Time
Detection languages
10
7
7
5
3
Contributors
22
3
3
2
2
Categories
29
19
18
12
5
Platforms
18
9
9
5
3
Products / Services
18
7
6
6
6
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
IDS Classtypes
3
IDS Protocols
3
Detects anomalous GCP IAM Service Account Credential API calls where a principal impersonates multiple distinct service accounts within a short time window. This behavior often indicates a credential delegation chain or a multi-stage privilege escalation attempt within a GCP environment.
Detects instances where a principal utilizes the iam:PassRole permission to assign a role with higher privileges to a newly created or updated compute resource (Lambda or EC2), potentially allowing the principal to assume the identity and elevated permissions of the passed role.
Detects the use of iam:PassRole to attach a potentially highly privileged IAM role (e.g., Administrator, PowerUser, FullAccess) to newly created or modified compute or serverless resources (EC2 instances, Lambda functions, Launch Templates, or Auto Scaling Groups). This behavior is indicative of an attacker attempting to escalate privileges by granting a managed resource excessive permissions that the attacker can subsequently abuse.
Detects potential privilege escalation sequences in AWS where an identity uses 'iam:PassRole' in conjunction with resource-creation APIs (such as 'lambda:CreateFunction', 'ec2:RunInstances', or 'cloudformation:CreateStack'). This pattern is indicative of an attacker attempting to attach a higher-privileged role to a newly created resource under their control, allowing them to perform actions beyond their current scope.
This rule detects the launch of an AWS EC2 instance that is configured with an IAM instance profile containing administrative keywords (e.g., AdministratorAccess, FullAccess) or a wildcard (*). Attackers can abuse this configuration after gaining initial access to the console or API to attach an over-privileged profile to a new instance, then pivot to the instance metadata service (IMDS) to extract these administrative credentials for persistent, broadly-scoped access.
Detects the creation of AWS Lambda functions by non-standard principals that assign an execution role with potentially broader privileges than the creator, indicative of an IAM privilege escalation technique where an attacker abuses iam:PassRole and lambda:CreateFunction to execute code under an elevated identity.
Detects successful AWS STS AssumeRole, AssumeRoleWithSAML, or AssumeRoleWithWebIdentity calls originating from an AWS account ID not included in the 'trusted_aws_accounts' lookup. The rule further enriches events with geolocation and ASN data to flag potential cross-account activity from high-risk or unexpected regions.
Detects anomalous GCP IAM Service Account Credential API calls where a principal impersonates multiple distinct service accounts within a short time window. This behavior often indicates a credential delegation chain or a multi-stage privilege escalation attempt within a GCP environment.
Detects potential privilege escalation in AWS where a user performs an iam:PassRole action to attach a highly privileged role (e.g., containing 'admin' or 'poweruser' in the name) to a newly created resource (Lambda, EC2 instance, or CloudFormation stack) within a short timeframe. This behavior is a known technique to gain elevated permissions by executing code within the context of a higher-privilege identity.
Detects a privilege escalation sequence where a principal uses 'PassRole' to attach an IAM role to a newly created compute resource (Lambda, EC2, or CloudFormation stack), followed shortly by that compute resource performing privileged API calls. This behavior indicates a potential attempt to gain unauthorized elevated permissions by executing actions from an over-privileged service identity.
Detects a privilege escalation sequence where a principal uses 'PassRole' to attach an IAM role to a newly created compute resource (Lambda, EC2, or CloudFormation stack), followed shortly by that compute resource performing privileged API calls. This behavior indicates a potential attempt to gain unauthorized elevated permissions by executing actions from an over-privileged service identity.
Detects a privilege escalation sequence where a principal uses 'PassRole' to attach an IAM role to a newly created compute resource (Lambda, EC2, or CloudFormation stack), followed shortly by that compute resource performing privileged API calls. This behavior indicates a potential attempt to gain unauthorized elevated permissions by executing actions from an over-privileged service identity.
This rule detects anomalous Privileged Identity Management (PIM) or Just-in-Time (JIT) role activation events. It identifies when a user activates a privileged role following suspicious activity such as a risky sign-in, during unusual (off-hours) time windows, or from an unfamiliar source IP address, potentially indicating session hijacking or credential abuse.
Detects potential privilege escalation where an identity with iam:PassRole permissions deploys or updates compute resources (CloudFormation, EC2, or Lambda) to assume a more privileged IAM role than the user currently holds.
Detects the use of sts:AssumeRole or sts:GetFederationToken to request temporary security credentials in a different AWS account than the one initiating the request. This can indicate cross-account privilege escalation or lateral movement using identity federation or assumed roles.
Detects potential privilege escalation where an identity with iam:PassRole permissions deploys or updates compute resources (CloudFormation, EC2, or Lambda) to assume a more privileged IAM role than the user currently holds.
Detects the use of sts:AssumeRole or sts:GetFederationToken to request temporary security credentials in a different AWS account than the one initiating the request. This can indicate cross-account privilege escalation or lateral movement using identity federation or assumed roles.
Detects potential AWS IAM privilege escalation attempts by identifying suspicious modifications to IAM policies, roles, or trust relationships, as well as unauthorized role assumption events. This rule monitors for activities such as attaching high-privilege policies (e.g., AdministratorAccess), creating new policy versions, and modifying trust policies to allow unexpected principals, which are common indicators of post-compromise activity designed to expand access within an AWS environment.
Detects a suspicious sequence of events: an anomalous login (new device, new location, or high-risk sign-in) followed by the assumption of a highly privileged role (via AssumeRole, PIM, or role elevation) and subsequent sensitive administrative actions (e.g., creating access keys, modifying IAM policies, or disabling security auditing). This pattern is indicative of cloud identity compromise and privilege escalation, commonly seen in attacks involving groups like Scattered Spider.
This rule detects high-volume usage (500+ events per hour) of Microsoft Exchange Online resources by accounts that lack an associated AccountObjectId but utilize a TokenObjectId. This pattern is indicative of service accounts or potentially compromised tokens performing bulk actions, such as mass email access or data collection within the Exchange environment.
Detects the use of sts:AssumeRoot within an AWS Organization. This action allows an entity within the management account to assume root-level access in a member account, effectively bypassing standard IAM restrictions. This is a high-risk event indicative of potential privilege escalation or management account compromise.
Page 1 of 2