Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
734 detections
Filters
Last updated
All Time
Detection languages
195
188
140
128
53
Contributors
229
147
111
94
34
Categories
613
214
127
93
73
Platforms
713
77
57
26
26
Products / Services
10,665
9,758
6,692
4,418
3,749
734
MITRE Techniques
294
276
143
124
106
CVEs
3
1
1
1
IDS Classtypes
5
5
4
2
IDS Protocols
16
This rule detects potential cloud service enumeration activity originating from a specific, potentially malicious IP address (23.234.84.102). It flags instances where this source IP performs specific API calls ('GetCallerIdentity' and 'ListTopics') without expected user-agent strings typical of legitimate AWS service traffic.
Detects the rare 'AssumeRoot' event in AWS STS followed by high-impact administrative or destructive API calls within a one-hour window. This behavior often indicates an adversary attempting to gain elevated, privileged access to perform unauthorized actions such as disabling logging, deleting infrastructure, or modifying IAM policies.
Detects bulk read operations on AWS Secrets Manager or similar cloud secret stores where the accessed resources contain keywords related to cryptocurrency custody, private keys, or wallet material. This pattern is indicative of unauthorized exfiltration attempts by threat actors such as Slim Spider targeting digital asset infrastructure.
Detects high-volume AI/LLM inference or GPU-compute provisioning activity from a single identity within a short duration. This behavior is indicative of LLMJacking, where compromised cloud credentials are used to spin up unauthorized, resource-intensive AI workloads for profit.
Detects high-volume AI/LLM inference or GPU-compute provisioning activity from a single identity within a short duration. This behavior is indicative of LLMJacking, where compromised cloud credentials are used to spin up unauthorized, resource-intensive AI workloads for profit.
Detects an identity that performs a 'ListSecrets' operation followed by a high volume of 'GetSecretValue' or 'BatchGetSecretValue' requests within a short timeframe (15 minutes). This behavioral pattern is indicative of automated bulk exfiltration of secrets from AWS Secrets Manager, a common activity following an initial cloud environment compromise.
Detects anomalous AWS STS GetCallerIdentity activity characterized by multiple failed authentication attempts (InvalidClientTokenId, SignatureDoesNotMatch, AccessDenied, AuthFailure, InvalidAccessKeyId). This pattern is consistent with an adversary performing bulk validation of stolen or harvested AWS IAM access keys to identify valid credentials.
Detects a pattern where a single source IP address performs multiple successful authentications across different cloud account identifiers within a short timeframe. This behavior is indicative of automated credential spraying, multi-agent automated access, or potential account takeover activity targeting multiple accounts within a cloud environment.
Detects a sequence of activity where an anonymous AWS token is requested via a specific API path, followed within 15 minutes by a token minting call from the same source IP. This behavior is indicative of a token-theft or privilege escalation chain.
Detects high-frequency S3 object upload activity (PutObject/CompleteMultipartUpload) originating from the Rclone tool, a common indicator of potential data exfiltration to cloud storage.
Detects rapid, sequential identity-validation API calls (such as GetCallerIdentity, GetSessionToken, or AssumeRole) performed across a large number of distinct AWS access keys from a single source within a short time window. This pattern is indicative of automated tooling validating a harvested corpus of AWS access keys to identify active credentials.
Detects rapid, sequential identity-validation API calls (such as GetCallerIdentity, GetSessionToken, or AssumeRole) performed across a large number of distinct AWS access keys from a single source within a short time window. This pattern is indicative of automated tooling validating a harvested corpus of AWS access keys to identify active credentials.
This rule detects various event types (email, identity authentication, network connections, and cloud audit logs) originating from or interacting with the specific IP address range 160.79.104.0/22 to 160.79.111.0/22, which is associated with known malicious activity.
Detects the creation of new AWS access keys or login profiles for a target identity immediately following the deletion or modification of a credential for the same identity, where the actors performing the two actions are different. This pattern indicates an adversary creating persistent access after a security incident responder or automated system has revoked a previously compromised credential.
This rule detects potential cloud service enumeration activity originating from a specific, potentially malicious IP address (23.234.84.102). It flags instances where this source IP performs specific API calls ('GetCallerIdentity' and 'ListTopics') without expected user-agent strings typical of legitimate AWS service traffic.
This rule detects potential cloud service enumeration activity originating from a specific, potentially malicious IP address (23.234.84.102). It flags instances where this source IP performs specific API calls ('GetCallerIdentity' and 'ListTopics') without expected user-agent strings typical of legitimate AWS service traffic.
This rule detects potential cloud service enumeration activity originating from a specific, potentially malicious IP address (23.234.84.102). It flags instances where this source IP performs specific API calls ('GetCallerIdentity' and 'ListTopics') without expected user-agent strings typical of legitimate AWS service traffic.
Detects multiple AWS API calls (Publish, GetCallerIdentity, ListTopics) originating from a specific IP address (23.234.84.102) associated with a Zapier SNS sender. This rule monitors for potentially unauthorized or anomalous API usage patterns by identifying repeated, successful, and non-error events from a known source that may indicate misuse or compromise of an integration account.
Detects multiple AWS API calls (Publish, GetCallerIdentity, ListTopics) originating from a specific IP address (23.234.84.102) associated with a Zapier SNS sender. This rule monitors for potentially unauthorized or anomalous API usage patterns by identifying repeated, successful, and non-error events from a known source that may indicate misuse or compromise of an integration account.
Detects multiple AWS API calls (Publish, GetCallerIdentity, ListTopics) originating from a specific IP address (23.234.84.102) associated with a Zapier SNS sender. This rule monitors for potentially unauthorized or anomalous API usage patterns by identifying repeated, successful, and non-error events from a known source that may indicate misuse or compromise of an integration account.
Detects multiple AWS API calls (Publish, GetCallerIdentity, ListTopics) originating from a specific IP address (23.234.84.102) associated with a Zapier SNS sender. This rule monitors for potentially unauthorized or anomalous API usage patterns by identifying repeated, successful, and non-error events from a known source that may indicate misuse or compromise of an integration account.
Page 12 of 35