Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
19 detections
Filters
Last updated
All Time
Detection languages
7
3
3
2
2
Contributors
14
1
1
1
1
Categories
16
15
4
3
1
Platforms
13
5
4
1
1
Products / Services
12
5
4
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects the creation of high-cost, resource-intensive compute instances (such as GPU-enabled or large-scale VMs) within cloud regions that have not been previously utilized by the account, subscription, or project. This behavior is often indicative of unauthorized resource hijacking, such as crypto-mining or large-scale data processing by threat actors.
The following analytic detects the creation of EC2 instances with previously unseen instance types.
It leverages Splunk's tstats command to analyze data from the Change data model, identifying instance types that have not been previously recorded.
This activity is significant for a SOC because it may indicate unauthorized or suspicious activity, such as an attacker attempting to create instances for malicious purposes.
If confirmed malicious, this could lead to unauthorized access, data exfiltration, system compromise, or service disruption. Immediate investigation is required to determine the legitimacy of the instance creation.
It leverages Splunk's tstats command to analyze data from the Change data model, identifying instance types that have not been previously recorded.
This activity is significant for a SOC because it may indicate unauthorized or suspicious activity, such as an attacker attempting to create instances for malicious purposes.
If confirmed malicious, this could lead to unauthorized access, data exfiltration, system compromise, or service disruption. Immediate investigation is required to determine the legitimacy of the instance creation.
Detects the deployment of virtual machines with public IP addresses (in Azure) or compute instances with external IP addresses (in GCP) by a single principal within a 15-minute window. This behavior is indicative of a newly-privileged identity or an compromised account establishing externally-accessible infrastructure for further malicious activity.
Detects the mass creation of high-performance compute instances (GPU or high-memory variants) in an AWS environment. By filtering out legitimate service-linked roles associated with auto-scaling, the rule isolates potentially unauthorized manual provisioning, often indicative of cryptojacking or resource hijacking.
Detects anomalous, large-scale provisioning of GPU-intensive cloud instances (such as p3, p4, g4dn, g5, and trn1 families) in AWS. This activity is indicative of cloud cryptojacking campaigns where adversaries hijack resources to rapidly spin up compute clusters for cryptomining, potentially incurring significant financial damage within a short period.
This rule detects the creation of compute resources (EC2 instances, launch templates, or spot instances) within AWS regions that are designated as dormant or rarely used. This behavior is a common indicator of regional 'region-hopping,' used by attackers for cryptojacking or establishing C2 infrastructure to evade detection, particularly in regions where monitoring and cost-based alerts are less mature.
Detects the launch of compute-optimized or GPU-accelerated EC2 instances via the RunInstances API. This behavior is a common indicator of unauthorized resource hijacking, such as cryptomining, where attackers leverage compromised credentials to deploy resource-intensive workloads in regions that have not been historically used by the organization.
Detects rapid, large-scale deployment of high-vCPU/GPU compute instances, potentially indicating resource hijacking for cryptomining. The rule correlates high-compute instance launches with preceding AWS service quota increases, identifying potential malicious activity within an AWS environment.
Detects the deployment of virtual machines with public IP addresses (in Azure) or compute instances with external IP addresses (in GCP) by a single principal within a 15-minute window. This behavior is indicative of a newly-privileged identity or an compromised account establishing externally-accessible infrastructure for further malicious activity.
Detects the rapid, bulk launch of GPU-optimized or compute-intensive EC2 instances via API calls such as RunInstances, CreateFleet, or RequestSpotFleet within a short time window. This behavior is often indicative of cloud resource hijacking or cryptojacking, where compromised credentials are used to spin up expensive compute resources for illicit mining or intensive processing.
Detects 'ec2:RunInstances' API calls occurring in AWS regions that are not part of the organization's approved allow-list. This behavior can be indicative of malicious infrastructure staging, such as deploying assets for unauthorized cryptomining or establishing pivot points in regions that are infrequently monitored.
Detects 'ec2:RunInstances' API calls occurring in AWS regions that are not part of the organization's approved allow-list. This behavior can be indicative of malicious infrastructure staging, such as deploying assets for unauthorized cryptomining or establishing pivot points in regions that are infrequently monitored.
Detects 'ec2:RunInstances' API calls occurring in AWS regions that are not part of the organization's approved allow-list. This behavior can be indicative of malicious infrastructure staging, such as deploying assets for unauthorized cryptomining or establishing pivot points in regions that are infrequently monitored.
Detects the creation of an AWS Lambda function that is assigned an excessively privileged execution role (e.g., AdministratorAccess). Attackers often leverage this technique to establish persistence or facilitate privilege escalation by creating backdoored functions that run with broad administrative permissions.
A Compute Engine instance created outside the expected europe-west1/europe-west2 regions.
Detects instances where an Azure Container Group is restarted within 30 minutes of a successful container image push to an Azure Container Registry in the same subscription. This pattern may indicate an automated or manual deployment process following a code update, which could be misused if unauthorized image pushes are occurring.
Detects the creation of virtual machines or the attachment of virtual hard disks (VHDs) using Hyper-V management tools, PowerShell, or Windows Disk Management utilities. This activity is often associated with efforts to bypass endpoint security monitoring by executing payloads within an unmanaged guest VM environment.
This rule detects attempts to create new cloud instances, specifically targeting AWS EC2, by monitoring HTTP traffic for requests to 'ec2.amazonaws.com' with the 'RunInstances' URI. The rule is designed to identify suspicious activity related to the provisioning of new virtual machines in a cloud environment, potentially indicating unauthorized resource creation or evasion tactics.
This rule detects the creation of virtual machines or the deployment of resources within an Azure environment. Monitoring these activities can help identify unauthorized resource provisioning, which could indicate an attacker establishing persistence, escalating privileges, or preparing for further malicious actions. The rule specifically looks for 'write' operations related to virtual machines and resource deployments in Azure activity logs.
