Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9 detections
Filters
Last updated
All Time
Detection languages
7
1
1
Contributors
6
3
Categories
8
4
3
2
2
Platforms
5
5
2
Products / Services
5
5
2
MITRE Techniques
18,079
15,542
12,519
8,344
6,154
Detects the weakening of "Block Public Access" setting of S3 buckets in CloudTrail logs.
Monitoring changes to Block Public Access settings is critical, as attackers may disable these safeguards before exposing a bucket through a public ACL or bucket policy.
Monitoring changes to Block Public Access settings is critical, as attackers may disable these safeguards before exposing a bucket through a public ACL or bucket policy.
Detects modifications to security groups, network security groups (NSG), or firewall rules across AWS, Azure, and GCP that expose sensitive management or database ports (22, 3389, 3306, 5432, 6379, 9200, 27017) to the entire internet (0.0.0.0/0). Such configurations significantly increase the attack surface and potential for unauthorized access, brute-force attacks, or data exposure.
Detects unauthorized or risky configuration changes in Google Cloud Storage or Azure Storage accounts that grant public access (e.g., allUsers/allAuthenticatedUsers or public blob access) specifically on storage resources identified as production or sensitive (PII/financial data).
Detects the modification of AWS Security Groups where management ports (SSH, RDP, WinRM, or common database ports) are opened to the entire internet (0.0.0.0/0 or ::/0). This activity is indicative of creating a network-layer backdoor to maintain persistence or facilitate lateral movement within a cloud environment.
Identifies when a firewall is created, modified, or deleted.
Detects that network ACL entries have been added to a route table which could indicate that new attack vectors have been opened up in the AWS account.
Detects the addition of a new network route to a route table in AWS.
Identifies when Rule Collections (Application, NAT, and Network) is being modified or deleted.
Identifies when a Firewall Policy is Modified or Deleted.