Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,653
12,600
8,411
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects instances where the suspicious binary 'x47_bot.exe' performs process injection or hollows a process, followed by an attempt to gain or elevate privileges (such as via UAC bypass, token manipulation, or privilege checking) on the same host within a 15-minute window.
Detects instances where the suspicious binary 'x47_bot.exe' performs process injection or hollows a process, followed by an attempt to gain or elevate privileges (such as via UAC bypass, token manipulation, or privilege checking) on the same host within a 15-minute window.
Detects potential arbitrary file download using a Microsoft Office application
Detects a potential ClickFix social engineering attack pattern where a user manually launches a script interpreter (e.g., PowerShell, cmd, mshta) from Windows Explorer followed within 30 minutes by the execution of 'rnpkeys.exe', a known indicator in installer side-load chains.
Detects the execution chain of the Sauron Loader malware. The rule identifies the side-loading of 'rnp.dll' by 'rnpkeys.exe' originating from the 'C:\ProgramData\keyroll' directory, followed by the loading of 'tdwp.dll' which facilitates in-memory decryption and execution. Persistence is confirmed by the creation or update of a scheduled task named 'keyroll'.
Detects known Sauron Loader MSI installer/DLL samples by SHA-256 or the rnpkeys.exe/rnp.dll/tdwp.dll side-load pairing referenced together in a file
Detects non-interactive Microsoft Entra ID service principal or managed identity sign-in events originating from an IP address, ASN, or country that has not been historically associated with that specific service principal. This behavior may indicate the use of compromised service principal credentials or stolen access tokens from adversary-controlled infrastructure.
Detects chained AWS STS AssumeRole/AssumeRoleWithSAML/AssumeRoleWithWebIdentity events where a principal assumes a role in a different account and then quickly performs another role assumption from that new context. This pattern, often referred to as 'role chaining' or 'role laundering', is frequently used to obfuscate identity tracking and facilitate lateral movement across AWS account boundaries.
Detects the use of iam:PassRole to attach a potentially highly privileged IAM role (e.g., Administrator, PowerUser, FullAccess) to newly created or modified compute or serverless resources (EC2 instances, Lambda functions, Launch Templates, or Auto Scaling Groups). This behavior is indicative of an attacker attempting to escalate privileges by granting a managed resource excessive permissions that the attacker can subsequently abuse.
Detects the creation of programmatic API credentials or service principal keys by highly privileged cloud identities across AWS, Azure, and GCP. Specifically monitors AWS Root, Azure AD Global/Company Administrators, and GCP Organization Owners, whose roles generally do not require long-term API access.
Detects successful cloud console login events across AWS, Azure, and GCP where multi-factor authentication (MFA) was not utilized, combined with impossible travel indicators (login from different countries within an 8-hour window for the same principal).
Detects instances where an Entra ID (Azure AD) application is registered and subsequently granted consent by the same user within 30 minutes, specifically when the activity occurs outside of typical business hours (7 AM - 7 PM) or from disparate IP addresses. This behavior pattern is indicative of potential malicious OAuth application registration and subsequent token-granting by an attacker to maintain persistent access to an environment.
Detects anomalous cross-account AssumeRole activities, including chained role assumptions, which are often used by cloud-native intrusion sets to launder access, evade single-account logging detection, and move laterally across AWS environments. The rule identifies AssumeRole events targeting non-allowlisted accounts or sequences where credentials are immediately used to perform further cross-account assumptions.
This rule detects the creation of compute resources (EC2 instances, launch templates, or spot instances) within AWS regions that are designated as dormant or rarely used. This behavior is a common indicator of regional 'region-hopping,' used by attackers for cryptojacking or establishing C2 infrastructure to evade detection, particularly in regions where monitoring and cost-based alerts are less mature.
Detects the creation or modification of credentials (access keys or login profiles) for the AWS root account or identities explicitly named to imply high-privilege administrative access. This is a high-fidelity indicator of persistence or unauthorized privilege escalation within an AWS environment.
Detects the launch of compute-optimized or GPU-accelerated EC2 instances via the RunInstances API. This behavior is a common indicator of unauthorized resource hijacking, such as cryptomining, where attackers leverage compromised credentials to deploy resource-intensive workloads in regions that have not been historically used by the organization.
This rule detects the launch of an AWS EC2 instance that is configured with an IAM instance profile containing administrative keywords (e.g., AdministratorAccess, FullAccess) or a wildcard (*). Attackers can abuse this configuration after gaining initial access to the console or API to attach an over-privileged profile to a new instance, then pivot to the instance metadata service (IMDS) to extract these administrative credentials for persistent, broadly-scoped access.
Detects the creation of an AWS IAM access key followed immediately by the use of that key from a new or anomalous geolocation, which is a strong indicator of credential theft or unauthorized key generation for persistence.
Detects successful AWS STS AssumeRole, AssumeRoleWithSAML, or AssumeRoleWithWebIdentity calls originating from an AWS account ID not included in the 'trusted_aws_accounts' lookup. The rule further enriches events with geolocation and ASN data to flag potential cross-account activity from high-risk or unexpected regions.
Detects the attachment or creation of IAM policies that grant administrative access (via 'AdministratorAccess' policy name) or full wildcard permissions ('Action': '*', 'Resource': '*') to users, roles, or groups. This activity is a common indicator of privilege escalation following a cloud identity compromise, frequently observed in campaigns by threat actors such as Scattered Spider (UNC3944).
Detects instances where a long-dormant Entra ID (Azure AD) service principal is reactivated shortly after having a new credential added or a new app role assigned. This activity is a potential persistence technique where an attacker repurposes a legitimate, high-privileged, but unused service principal to blend in as legacy automation.
Page 48 of 864