Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
98 detections
Filters
Last updated
All Time
Detection languages
45
19
10
8
6
Contributors
23
20
10
8
6
Categories
79
44
11
11
8
Platforms
46
36
15
10
10
Products / Services
30
28
20
10
6
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
2
IDS Classtypes
4
1
IDS Protocols
5
This rule detects repeated HTTP requests to 'management.azure.com' with the URI '/resources', indicating an attempt to enumerate Azure resource groups. The threshold of 10 requests within 30 seconds from the same source is set to identify potential scanning or reconnaissance activities.
This rule detects when a user performs a security investigation query within Google Workspace using the Security Investigation Tool. It extracts the user's UPN, the data source being investigated, and the query itself. This can help identify potential insider threat activity, unauthorized investigations, or unusual administrative behavior.
Detects Bun or Node.js processes spawned from temporary directories making requests
to cloud instance metadata services (AWS IMDSv2, Azure IMDS). The Miasma worm
harvests cloud credentials from CI runners via these endpoints.
to cloud instance metadata services (AWS IMDSv2, Azure IMDS). The Miasma worm
harvests cloud credentials from CI runners via these endpoints.
Detects Mini Shai-Hulud supply-chain malware (router_init.js / router_runtime.js / tanstack_runner.js)
Detects Node.js or Bun processes making HTTP requests to AWS IMDS or ECS metadata endpoints,
indicative of credential harvesting by the Mini Shai-Hulud malware.
indicative of credential harvesting by the Mini Shai-Hulud malware.
Detects Mini Shai-Hulud supply-chain malware (router_init.js / router_runtime.js / tanstack_runner.js)
Detects Node.js or Bun processes making HTTP requests to AWS IMDS or ECS metadata endpoints, indicative of credential harvesting.
Identifies potential use of ROADtools for Azure AD reconnaissance by monitoring for Azure CLI/PowerShell App IDs coupled with a Python user agent in sign-in logs. This rule specifically looks for sign-ins to 'Windows Azure Active Directory' resource where the user agent string contains 'python' or the device detail string contains 'Python', and the App ID or App Display Name matches known Azure AD PowerShell or Azure CLI applications.
Detects the execution of the TruffleHog secret scanning tool. This tool is often used by attackers to find sensitive information like credentials in various data sources (filesystems, Git repositories, cloud storage, etc.). This rule identifies the process creation of TruffleHog and categorizes the type of scan being performed. It includes exclusions for legitimate CI/CD environments or security scanners.
Detects when a successful AWS Console Login is immediately followed by discovery actions from the same user and IP address. This pattern is indicative of an attacker performing reconnaissance after gaining initial access, as seen in recent AWS phishing campaigns.
Detects TruffleHog credential validation via sts:GetCallerIdentity - initial access indicator for AWS WorkMail phishing campaigns
Detects anomalous increases in AWS API calls resulting in "AccessDenied" errors for a single identity and source IP address, relative to that identity's historical baseline over the past 30 days. Sudden increases in denied requests or the variety of APIs being denied may indicate reconnaissance, permission probing, or misconfigured automation attempts by an adversary.
This rule detects potential enumeration of AWS S3 buckets by looking for the 'ListBuckets' API call in AWS CloudTrail logs. It specifically filters out activities performed by 'AssumedRole' identities to reduce false positives from legitimate automated processes or services.
Looks for potential enumeration of AWS buckets via ListBuckets.
KQL Query from file: EntraFalcon Detection
KQL Query from file: DefenderXDR Weekly OSINT Indicators Scan 05052025
KQL Query from file: DefenderXDR Weekly OSINT Indicators Scan
KQL Query from file: DefenderXDR Weekly OSINT Indicators Scan 24022025
KQL Query from file: DefenderXDR Weekly OSINT Indicators Scan 19052025
SPL Query from file: Enumeration of GCP Infrastructure
The following analytic identifies a high number of AccessDenied attempts to list AWS Bedrock foundation models. It leverages AWS CloudTrail logs to detect when a user or service experiences multiple failures when calling the ListFoundationModels API. This activity is significant as it may indicate an adversary performing reconnaissance of available AI models after compromising credentials with limited permissions. Repeated failures could suggest brute force attempts to enumerate accessible resources or misconfigured access controls. If confirmed malicious, this could represent early-stage reconnaissance before attempting to access or manipulate Bedrock models or knowledge bases.
Page 4 of 5