Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
13 detections
Filters
Last updated
All Time
Detection languages
7
2
2
2
Contributors
3
3
3
2
1
Categories
12
11
6
1
1
Platforms
8
6
Products / Services
9
5
2
2
1
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
IDS Classtypes
2
IDS Protocols
2
This rule detects suspicious activities targeting cloud management hierarchy, specifically identifying attempts to remove AWS accounts from organizations, disable policy enforcement, create rogue accounts, or hijack Azure subscriptions through unauthorized transfers or tenant changes. Such actions are often used by adversaries to bypass security guardrails, remove organizational visibility, or establish persistent unauthorized access within a cloud environment.
Detects suspicious modifications to AWS Organization structure, specifically the moving of accounts out of protected organizational units (e.g., security, quarantine, guardrail), accounts leaving the organization, or the detachment of policies, which may indicate an attempt to evade security controls or organizational guardrails.
Detects suspicious modifications to AWS Organization structure, specifically the moving of accounts out of protected organizational units (e.g., security, quarantine, guardrail), accounts leaving the organization, or the detachment of policies, which may indicate an attempt to evade security controls or organizational guardrails.
Detects high-impact configuration changes to Azure management groups or subscriptions (e.g., write/delete operations) that are performed by non-privileged accounts or outside of defined business change windows. This activity can indicate unauthorized privilege escalation, resource manipulation, or reconnaissance by an adversary.
Detects high-impact configuration changes to Azure management groups or subscriptions (e.g., write/delete operations) that are performed by non-privileged accounts or outside of defined business change windows. This activity can indicate unauthorized privilege escalation, resource manipulation, or reconnaissance by an adversary.
Detects high-impact configuration changes to Azure management groups or subscriptions (e.g., write/delete operations) that are performed by non-privileged accounts or outside of defined business change windows. This activity can indicate unauthorized privilege escalation, resource manipulation, or reconnaissance by an adversary.
Detects modification of AWS organizational units to evade policy controls
This rule detects when an AWS Organization Unit (OU) is modified, specifically when the 'MoveAccount' API call is made to 'organizations.amazonaws.com'. This activity could indicate an attempt to evade detection or alter the organizational structure for malicious purposes.
This rule detects attempts to modify an Azure Management Group, specifically when a PUT request is made to 'management.azure.com' with 'managementGroups' in the URI. This activity could indicate an attempt to evade defenses by altering management group configurations.
KQL Query
'Indicates when an anomalous number of resources are created in Azure via AzureActivity log. Resource creation could indicate malicious or spurious use of your Azure Resource allocation.'
'This query look for users starting an Azure CloudShell session and summarizes the Azure Activity from that
user account during that timeframe (by default 1 hour). This can be used to help identify abuse of the CloudShell
to modify Azure resources.'
user account during that timeframe (by default 1 hour). This can be used to help identify abuse of the CloudShell
to modify Azure resources.'
The following analytic detects cloud provisioning activities originating from previously unseen IP addresses. It leverages cloud infrastructure logs to identify events where resources are created or started, and cross-references these with a baseline of known IP addresses. This activity is significant as it may indicate unauthorized access or potential misuse of cloud resources. If confirmed malicious, an attacker could gain unauthorized control over cloud resources, leading to data breaches, service disruptions, or increased operational costs.
