Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10 detections
Filters
Last updated
All Time
Detection languages
6
1
1
1
1
Contributors
6
2
1
1
Categories
10
8
3
1
1
Platforms
8
1
1
Products / Services
8
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects unauthorized sharing of AWS EBS snapshots or RDS snapshots to external, unapproved AWS accounts. This activity is often a precursor to data exfiltration, where an adversary creates a snapshot of a production resource and shares it with an account under their control to bypass existing identity-based access controls.
Detects the modification of EBS snapshot or AMI attributes to add createVolumePermission or launchPermission, which enables sharing the resource with an external AWS account. This action is a common precursor to cross-account data exfiltration or extortion via snapshot/AMI hijacking.
Detects modifications to EBS or RDS snapshot permissions that grant access to the public 'all' group or an external AWS account ID. This activity is a common method for exfiltrating sensitive data via unauthorized cross-account sharing, bypassing standard VPC egress monitoring and DLP controls.
Detects unauthorized cross-account copying of AWS EC2 or RDS snapshots, a key indicator of data exfiltration or staging as part of a snapshot-theft attack chain. The rule correlates copy events where the source snapshot owner is different from the destination account ID.
Detects modifications to EBS snapshot attributes via ModifySnapshotAttribute where the snapshot is made publicly accessible (all group) or shared with an unauthorized AWS account ID, potentially indicating unauthorized exfiltration of disk contents.
Detects modifications to AWS EC2 snapshot or AMI attributes that grant cross-account permissions, including making them publicly accessible. This activity may indicate an attempt to exfiltrate volume data, such as credentials, configuration, or database contents, to an external AWS account.
A Compute Engine image created from a disk, which can be used to copy VM disk data out of the environment
Detects cloud disk snapshot creation potentially for data exfiltration
This rule detects when a cloud disk snapshot is created, specifically targeting AWS EC2 'CreateSnapshot' API calls. This activity can be indicative of data exfiltration attempts, where an attacker creates a snapshot of a compromised disk to move data out of the environment.
This rule identifies rare subscription-level operations in Azure, specifically focusing on actions that involve listing keys for various Azure resources (DocumentDB, Maps, Media, Cognitive Services, Storage) or writing snapshots and network security groups. It aims to detect when these sensitive operations are performed from a previously unseen source IP address, indicating potential unauthorized access or credential compromise.
