Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4 detections
Filters
Last updated
All Time
Detection languages
3
1
Contributors
2
1
1
Categories
4
3
1
1
1
Platforms
4
1
Products / Services
4
1
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
A successful EC2 StopInstances request was followed within one hour by a successful ModifyInstanceAttribute request targeting userData on the same instance, by the same IAM principal.
This may indicate an attempt to change instance startup behavior or establish persistence.
These CloudTrail events do not confirm that the modified user-data script executed.
This may indicate an attempt to change instance startup behavior or establish persistence.
These CloudTrail events do not confirm that the modified user-data script executed.
Detects administrative actions intended to disable, modify, or suppress logging and alerting capabilities within AWS and Azure, specifically targeting services like Amazon GuardDuty, AWS Security Hub, AWS Config, and Microsoft Defender for Cloud. Such actions are frequently observed as a precursor to unauthorized activity to hide malicious actions from detection systems.
This rule detects attempts to modify an EC2 instance's attributes, specifically looking for the 'ModifyInstanceAttribute' API call to 'ec2.amazonaws.com'. This activity could indicate an attacker attempting to evade detection or alter the instance's configuration for malicious purposes.
The following analytic identifies unusual modifications to security groups in your cloud environment by users, focusing on actions such as modifications, deletions, or creations over 30-minute intervals. It leverages cloud infrastructure logs and calculates the standard deviation for each user, using the 3-sigma rule to detect anomalies. This activity is significant as it may indicate a compromised account or insider threat. If confirmed malicious, attackers could alter security group configurations, potentially exposing sensitive resources or disrupting services.