Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
37 detections
Filters
Last updated
All Time
Detection languages
19
7
5
3
3
Contributors
31
3
1
1
1
Categories
34
25
17
15
5
Platforms
27
9
6
3
1
Products / Services
27
9
6
6
5
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
Detects malicious attempts to delete or modify the access control settings of centralized cloud audit log storage, such as S3 buckets, Azure Log Analytics workspaces, or GCP log buckets. These actions aim to impair visibility into an adversary's activities, a common step in anti-forensics and data destruction workflows.
Detects high-risk AWS API calls indicative of privilege escalation within IAM (e.g., policy attachments, credential creation) or activities aimed at tampering with or disabling CloudTrail logging, which is often a precursor to or indication of unauthorized activity to evade detection.
Detects attempts by a principal to modify, stop, or delete AWS CloudTrail logging configurations. Such activity is a common indicator of defense evasion during the early stages of a cloud-based attack to prevent audit trail capture.
Detects unauthorized attempts to delete or purge critical Salesforce audit logs, including the Setup Audit Trail, Login History, and Event Monitoring log files. This behavior is indicative of anti-forensic activity, often utilized by threat actors such as ShinyHunters to destroy audit evidence following unauthorized access, data export, or credential manipulation.
Detects unauthorized or suspicious modifications to audit and logging configurations across AWS, Azure, and GCP. The rule identifies actions such as stopping, deleting, or updating logging trails, diagnostic settings, or logging sinks, which may indicate an adversary attempting to impair visibility into their activities (Anti-Forensics).
Detects unauthorized attempts to modify or delete AWS CloudTrail logs stored in S3, or changes to the S3 bucket lifecycle configuration that would shorten the log retention period. This activity is indicative of an adversary attempting to clear their tracks or hinder audit capabilities.
Detects unauthorized modifications or deletions of cloud logging sinks in Google Cloud Platform (GCP) or diagnostic settings in Azure, which may indicate an attacker attempting to disable audit logs to cover their tracks or evade detection.
Detects unauthorized modification or deletion of AWS Bedrock model invocation logging configurations. Adversaries may use this technique to disable visibility into LLM usage or redirect logs to an attacker-controlled storage location to hide subsequent malicious activity.
This rule detects modifications to AWS CloudTrail configurations that reduce logging visibility, such as stopping the logging service, deleting a trail, or updating a trail to include restrictive event selectors (e.g., non-multi-region, read-only events, or excluding management events). These actions are indicative of an attacker attempting to evade detection by limiting the audit trail available to security analysts.
This rule detects administrative actions in GCP that involve modifying or deleting Cloud Logging sinks, or disabling specific services, with a specific focus on disabling the logging service itself. Adversaries may perform these actions to tamper with audit trails and evade detection of malicious activities.
Detects malicious attempts to delete or modify the access control settings of centralized cloud audit log storage, such as S3 buckets, Azure Log Analytics workspaces, or GCP log buckets. These actions aim to impair visibility into an adversary's activities, a common step in anti-forensics and data destruction workflows.
Detects unauthorized attempts to stop, delete, or reduce the scope of AWS CloudTrail logging. Attackers frequently perform these actions to blind defenders before conducting large-scale resource abuse or ransomware activities. This rule monitors for StopLogging, DeleteTrail, and configuration changes (UpdateTrail, PutTrail) that weaken log integrity such as disabling multi-region tracking, global service events, or log file validation.
Detects attempts to tamper with or disable AWS security monitoring controls, specifically GuardDuty detectors and AWS Config recording. Attackers frequently disable these services to evade detection after gaining administrative permissions in a cloud environment.
Detects the deletion of AWS CloudWatch log groups, log streams, metric filters, CloudWatch alarms, and VPC Flow Logs. Such actions are often indicative of an adversary attempting to destroy forensic evidence or disable security alerting prior to further unauthorized activity, such as data exfiltration or resource abuse.
Detects modifications to AWS CloudTrail event selectors that result in a loss of audit coverage (e.g., stopping management event logging or narrowing the ReadWriteType), which is a technique used by sophisticated actors to silently evade detection while keeping the trail status as enabled.
Detects unauthorized attempts to stop CloudTrail logging or delete existing CloudTrail configurations within an AWS environment. Disabling logging is a significant indicator of defense evasion, often used by attackers to mask subsequent malicious activities such as data exfiltration, privilege escalation, or resource abuse.
Detects AWS CloudTrail events where VPC Flow Logs are disabled or deleted, potentially indicating an adversary attempting to evade network monitoring by blinding detection mechanisms for lateral movement or data exfiltration.
Detects the deletion of Azure Monitor diagnostic settings or log profiles that export subscription-level Activity Logs. This action disables logging, effectively blinding security visibility into tenant operations, and is often used by adversaries as a defense-evasion technique before conducting further malicious activities.
Detects unauthorized attempts to delete CloudTrail log files or destroy the underlying storage bucket used for logs. This activity is a form of anti-forensics intended to remove evidence of malicious activity within the cloud control plane. The detection excludes legitimate automated S3 lifecycle management events.
Detects unauthorized attempts to delete CloudTrail log files or destroy the underlying storage bucket used for logs. This activity is a form of anti-forensics intended to remove evidence of malicious activity within the cloud control plane. The detection excludes legitimate automated S3 lifecycle management events.
Detects administrative actions intended to disable, modify, or suppress logging and alerting capabilities within AWS and Azure, specifically targeting services like Amazon GuardDuty, AWS Security Hub, AWS Config, and Microsoft Defender for Cloud. Such actions are frequently observed as a precursor to unauthorized activity to hide malicious actions from detection systems.
Page 1 of 2