Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
13 detections
Filters
Last updated
All Time
Detection languages
4
4
2
2
1
Contributors
4
2
1
1
1
Categories
11
4
4
3
3
Platforms
4
4
4
3
2
Products / Services
4
3
2
2
1
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
3
1
IDS Protocols
4
Detects a suspicious behavioral sequence in AWS CloudTrail logs from external IPs using the Boto3 user agent. The sequence starts with caller-identity validation (GetCallerIdentity), followed by a high volume of secret reads (Secrets Manager) or cloud storage object reads (S3), indicating automated reconnaissance, credential theft, or data exfiltration.
Detects potential cloud storage object discovery activity in Azure Blob Storage by identifying anomalous listing or enumeration operations from callers, including high request counts, extensive container access, high failure rates, or anonymous authentication.
Detects a suspicious sequence of events where Kubernetes API resources (namespaces, secrets, configmaps, pods, or nodes) are enumerated, followed by a search query against the Slack API, indicative of a potential reconnaissance phase or sandbox escape attempt.
Detects instances where an Android application, installed from a non-standard source (sideloaded via ADB or unknown sources), requests the BIND_ACCESSIBILITY_SERVICE permission for a service named 'SystemHelper'. This behavior is characteristic of mobile malware like Rathat that leverages accessibility services to gain unauthorized control over user credentials and bank accounts.
Detects anomalous, high-volume activity directed at SharePoint and OneDrive Graph API endpoints (e.g., /sites, /drives, /search, /children). The activity pattern, characterized by multiple distinct path requests and the usage of pagination tokens within a short timeframe, strongly indicates an adversary attempting to map the file structure and contents of a repository prior to data collection or exfiltration.
Detects enumeration of cloud storage objects for data discovery
Detects high volume Google Cloud Storage (GCS) object listing and downloads, which can indicate reconnaissance of cloud storage contents or data exfiltration. The rule correlates multiple 'storage.objects.list' and 'storage.objects.get' operations within a one-hour window from the same identity, bucket, and project, flagging activity exceeding 50 operations.
Detects high volume Google Cloud Storage (GCS) object listing and downloads, which can indicate reconnaissance of cloud storage contents or data exfiltration. The rule aggregates operations by identity, bucket, and project ID over a one-hour period and flags activity exceeding 50 total operations.
This rule detects attempts to enumerate objects within a Google Cloud Storage (GCS) bucket. It triggers when HTTP requests are made to 'storage.googleapis.com' with a URI containing '/b/', indicating an attempt to access or list buckets or their contents. The thresholding mechanism (10 events within 30 seconds from the same source IP) aims to identify rapid, potentially automated, enumeration activities.
This rule detects attempts to enumerate Azure Blob Storage containers. It specifically looks for HTTP requests targeting Azure Blob storage hosts (ending with '.blob.core.windows.net') and containing the query parameter '?comp=list', which is used to list containers within a storage account. This activity is indicative of reconnaissance or discovery against Azure cloud resources.
This rule detects attempts to enumerate AWS S3 object lists, which could indicate data discovery activities. It specifically looks for HTTP requests to s3.amazonaws.com or .s3-website domains containing the string 'list' in the URI, with a threshold of 10 occurrences within 30 seconds from the same source.
Looks for potential enumeration of AWS buckets via ListBuckets.
'This hunting query looks for increases in the number of workspaces queried by a user.'
