Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
38 detections
Filters
Last updated
All Time
Detection languages
25
5
3
2
2
Contributors
7
5
5
3
3
Categories
33
28
7
5
4
Platforms
23
9
6
3
3
Products / Services
13
9
8
5
3
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
IDS Classtypes
3
IDS Protocols
3
Detects one identity reading secrets from several Azure Key Vaults in a day beyond its own 14 day baseline, which matches the bulk secret reads Microsoft reported after the ConnectWise application compromise. It needs the CloudKeyVaultEvents table, does not flag an identity that already reads many vaults every day and cannot show whether the reads were legitimate. The query ran without errors in a live tenant.
Detects a suspicious behavioral sequence in AWS CloudTrail logs from external IPs using the Boto3 user agent. The sequence starts with caller-identity validation (GetCallerIdentity), followed by a high volume of secret reads (Secrets Manager) or cloud storage object reads (S3), indicating automated reconnaissance, credential theft, or data exfiltration.
Detects a high volume of Azure Key Vault secret reads or key decryption operations performed by a single caller identity from multiple source IP addresses within a one-hour window, which may indicate credential harvesting or unauthorized access.
The following analytic detects an AWS principal making more than 10 distinct successful Secrets Manager BatchGetSecretValue API calls within one hour. It groups calls by AWS account and user identity ARN and deduplicates CloudTrail events by event ID. Repeated batch retrieval may indicate bulk access to secrets using a compromised identity, although legitimate automation can produce similar activity.
This rule detects potential unauthorized access to Azure Key Vault secrets by correlating AI agent process execution on an endpoint with subsequent Key Vault API activity by the same user account. It tracks common AI coding/assistant tools running locally on a device and triggers an alert if the same identity accesses cloud-plane Key Vault operations within 5 minutes. Additionally, it identifies anomalous bulk secret enumeration patterns in Key Vault audit logs to detect potential automated exfiltration.
This rule detects potential unauthorized access to Azure Key Vault secrets by correlating AI agent process execution on an endpoint with subsequent Key Vault API activity by the same user account. It tracks common AI coding/assistant tools running locally on a device and triggers an alert if the same identity accesses cloud-plane Key Vault operations within 5 minutes. Additionally, it identifies anomalous bulk secret enumeration patterns in Key Vault audit logs to detect potential automated exfiltration.
Detects an identity that performs a 'ListSecrets' operation followed by a high volume of 'GetSecretValue' or 'BatchGetSecretValue' requests within a short timeframe (15 minutes). This behavioral pattern is indicative of automated bulk exfiltration of secrets from AWS Secrets Manager, a common activity following an initial cloud environment compromise.
This rule detects potential unauthorized access to Azure Key Vault secrets by correlating AI agent process execution on an endpoint with subsequent Key Vault API activity by the same user account. It tracks common AI coding/assistant tools running locally on a device and triggers an alert if the same identity accesses cloud-plane Key Vault operations within 5 minutes. Additionally, it identifies anomalous bulk secret enumeration patterns in Key Vault audit logs to detect potential automated exfiltration.
This rule detects potential unauthorized access to Azure Key Vault secrets by correlating AI agent process execution on an endpoint with subsequent Key Vault API activity by the same user account. It tracks common AI coding/assistant tools running locally on a device and triggers an alert if the same identity accesses cloud-plane Key Vault operations within 5 minutes. Additionally, it identifies anomalous bulk secret enumeration patterns in Key Vault audit logs to detect potential automated exfiltration.
This rule detects potential unauthorized access to Azure Key Vault secrets by correlating AI agent process execution on an endpoint with subsequent Key Vault API activity by the same user account. It tracks common AI coding/assistant tools running locally on a device and triggers an alert if the same identity accesses cloud-plane Key Vault operations within 5 minutes. Additionally, it identifies anomalous bulk secret enumeration patterns in Key Vault audit logs to detect potential automated exfiltration.
Detects high-velocity retrieval of multiple secrets from AWS Secrets Manager using a single IAM role or session shortly after activity initiation. This behavior is indicative of automated credential harvesting, often occurring post-compromise of a host (e.g., an SSH bastion) that has been assigned a high-privilege IAM role.
Detects 'GetSecretValue' API calls to AWS Secrets Manager originating from programmatic agents like Boto3, Python requests, or the AWS CLI. This monitors for automated retrieval of stored secrets, which may indicate unauthorized credential access or exfiltration from an AWS environment.
Detects an identity that performs a 'ListSecrets' operation followed by a high volume of 'GetSecretValue' or 'BatchGetSecretValue' requests within a short timeframe (15 minutes). This behavioral pattern is indicative of automated bulk exfiltration of secrets from AWS Secrets Manager, a common activity following an initial cloud environment compromise.
This rule monitors Azure Key Vault operations, specifically focusing on unauthorized or excessive retrieval of secrets, keys, or certificates. It triggers when a specific user or service principal makes 10 or more requests for unique assets within a 10-minute window, which may indicate automated discovery, mass exfiltration, or a brute-force attempt to harvest credentials stored within the vault.
This rule monitors Azure Key Vault operations, specifically focusing on unauthorized or excessive retrieval of secrets, keys, or certificates. It triggers when a specific user or service principal makes 10 or more requests for unique assets within a 10-minute window, which may indicate automated discovery, mass exfiltration, or a brute-force attempt to harvest credentials stored within the vault.
Detects node.exe accessing Chrome browser extension storage directories associated with popular cryptocurrency wallets. This activity is indicative of the Miasma/MYRA infostealer (peer-math.js) attempting to harvest encrypted wallet vaults from developer workstations, as seen in the Polymarket Trap supply chain attack.
Detects a successful Key Vault access policy or role change that grants secret-reading capability to a user or service principal. This could indicate an adversary attempting to gain access to sensitive credentials stored in Azure Key Vault.
Detects Key Vault access policy or role changes that grant secret-reading capabilities.
Detects a single identity rapidly reading a large number of distinct secrets from an Azure Key Vault within a short timeframe (10 minutes). This behavior is indicative of automated secret harvesting, potentially by an attacker who has compromised an identity with access to the Key Vault. The rule specifically looks for at least 25 reads and 10 distinct secrets accessed by the same identity and IP address within the time window.
Detects retrieval of secrets from AWS Secrets Manager
Detects retrieval of secrets from AWS Secrets Manager
Page 1 of 2