Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
26 detections
Filters
Last updated
All Time
Detection languages
14
5
2
2
1
Contributors
11
6
5
2
1
Categories
21
8
6
6
5
Platforms
12
10
7
5
5
Products / Services
7
6
5
5
3
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
3
1
1
IDS Protocols
4
1
This rule detects HTTP POST requests to 'cloudfunctions.net', indicating a Google Cloud Function is being triggered for execution. The rule uses a threshold to alert only if 20 such requests are observed from the same source within 60 seconds, aiming to reduce noise from legitimate, infrequent triggers.
This rule detects HTTP POST requests to AWS Lambda invocation endpoints, specifically targeting URLs matching the pattern '/lambda.[a-z0-9-]+.amazonaws.com' with the URI '/invocations'. A threshold of 20 such requests within 60 seconds from a single source IP triggers the alert, indicating potential code execution activity via AWS Lambda.
Detects the HazyBeacon backdoor, which leverages AWS Lambda URLs for C2 communication and uses custom tools for data exfiltration. The rule identifies known malicious file hashes, suspicious tool drops in C:\ProgramData, specific service creation commands for persistence, and network connections from the sideloaded host process (mscorsvw.exe) to AWS Lambda URLs.
Detects when an IAM user attempts to update or modify the code of an AWS Lambda function. This activity can be indicative of an attacker trying to introduce malicious code, backdoor existing functions, or alter their behavior for persistence, privilege escalation, or other malicious purposes.
Detects an IAM user attempting to update/modify AWS lambda code.
Page 2 of 2