Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
98 detections
Filters
Last updated
All Time
Detection languages
45
19
10
8
6
Contributors
23
20
10
8
6
Categories
79
44
11
11
8
Platforms
46
36
15
10
10
Products / Services
30
28
20
10
6
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
2
IDS Classtypes
4
1
IDS Protocols
5
Detects when a single AWS user identity or IP address enumerates multiple resources across different AWS services (such as SQS, Lambda, ECS, CodeDeploy, S3, RDS, Athena) within a short time window, indicating potential reconnaissance or discovery activity.
Detects a single identity/IP querying Microsoft Graph endpoints for directory roles, role management, registered authentication methods, applications, service principals, OAuth2 permission grants, and app role assignments within a short window - control-plane reconnaissance mapping privilege escalation and persistence opportunities
Detects a suspicious sequence of events where Kubernetes API resources (namespaces, secrets, configmaps, pods, or nodes) are enumerated, followed by a search query against the Slack API, indicative of a potential reconnaissance phase or sandbox escape attempt.
This rule detects potentially malicious reconnaissance or enumeration activity by tracking high volumes of read-only API calls (LIST/read operations) across multiple Azure resource providers (e.g., VMs, Subscriptions, Web sites, Storage, Recovery Services) performed by a single identity within a 30-minute window.
Detects a suspicious sequence of behavior where an Azure service principal authenticates and immediately performs broad reconnaissance (enumeration) across multiple subscriptions and resource types. This pattern is often indicative of an adversary using a compromised service principal credential to map out an environment.
Detects anomalous, high-volume enumeration activity (List/Get/Read operations) performed by a single identity across multiple Azure resource providers within a short time window, indicative of automated reconnaissance by a compromised service principal or managed identity.
Detects a suspicious pattern often associated with Storm-3168 (JADEPUFFER) activity: prolonged, high-volume Azure resource enumeration by one service principal, followed shortly by a second service principal performing rapid, multi-subscription enumeration from the same source IP address.
Detects a precursor pattern identified as JADEPUFFER, where a failed 'ListKeys' operation (indicating an attempt to discover or access keys for a non-existent storage account) is immediately followed by a burst of destructive delete operations on critical cloud resources (e.g., storage, databases, key vaults) by the same actor.
Detects a suspicious pattern often associated with Storm-3168 (JADEPUFFER) activity: prolonged, high-volume Azure resource enumeration by one service principal, followed shortly by a second service principal performing rapid, multi-subscription enumeration from the same source IP address.
This rule detects potentially malicious activity where an identity performs enumeration of Kubernetes secrets or configmaps and subsequently performs a search action within Slack from the same IP address within a one-hour window. This behavioral pattern is indicative of post-breakout reconnaissance, where a compromised identity or token is used to exfiltrate sensitive cloud configuration data and then perform internal reconnaissance in SaaS collaboration tools to identify further targets or credentials.
Detects a suspicious sequence of behavior where an Azure service principal authenticates and immediately performs broad reconnaissance (enumeration) across multiple subscriptions and resource types. This pattern is often indicative of an adversary using a compromised service principal credential to map out an environment.
Detects a suspicious sequence of behavior where an Azure service principal authenticates and immediately performs broad reconnaissance (enumeration) across multiple subscriptions and resource types. This pattern is often indicative of an adversary using a compromised service principal credential to map out an environment.
Detects a suspicious sequence of behavior where an Azure service principal authenticates and immediately performs broad reconnaissance (enumeration) across multiple subscriptions and resource types. This pattern is often indicative of an adversary using a compromised service principal credential to map out an environment.
Detects a precursor pattern identified as JADEPUFFER, where a failed 'ListKeys' operation (indicating an attempt to discover or access keys for a non-existent storage account) is immediately followed by a burst of destructive delete operations on critical cloud resources (e.g., storage, databases, key vaults) by the same actor.
Detects anomalous, high-velocity enumeration of IAM entities and cloud infrastructure resources by a single principal within a 5-minute window. This behavior is consistent with automated reconnaissance performed by agentic AI or scripted tools, often used to map cloud environments prior to exploitation.
Detects a suspicious sequence of behavior where an Azure service principal authenticates and immediately performs broad reconnaissance (enumeration) across multiple subscriptions and resource types. This pattern is often indicative of an adversary using a compromised service principal credential to map out an environment.
Detects a precursor pattern identified as JADEPUFFER, where a failed 'ListKeys' operation (indicating an attempt to discover or access keys for a non-existent storage account) is immediately followed by a burst of destructive delete operations on critical cloud resources (e.g., storage, databases, key vaults) by the same actor.
Detects a precursor pattern identified as JADEPUFFER, where a failed 'ListKeys' operation (indicating an attempt to discover or access keys for a non-existent storage account) is immediately followed by a burst of destructive delete operations on critical cloud resources (e.g., storage, databases, key vaults) by the same actor.
Detects a precursor pattern identified as JADEPUFFER, where a failed 'ListKeys' operation (indicating an attempt to discover or access keys for a non-existent storage account) is immediately followed by a burst of destructive delete operations on critical cloud resources (e.g., storage, databases, key vaults) by the same actor.
Detects a suspicious pattern often associated with Storm-3168 (JADEPUFFER) activity: prolonged, high-volume Azure resource enumeration by one service principal, followed shortly by a second service principal performing rapid, multi-subscription enumeration from the same source IP address.
Detects a suspicious pattern often associated with Storm-3168 (JADEPUFFER) activity: prolonged, high-volume Azure resource enumeration by one service principal, followed shortly by a second service principal performing rapid, multi-subscription enumeration from the same source IP address.
Page 1 of 5