Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
734 detections
Filters
Last updated
All Time
Detection languages
195
188
140
128
53
Contributors
229
147
111
94
34
Categories
613
214
127
93
73
Platforms
713
77
57
26
26
Products / Services
10,664
9,758
6,692
4,418
3,749
734
MITRE Techniques
294
276
143
124
106
CVEs
3
1
1
1
IDS Classtypes
5
5
4
2
IDS Protocols
16
This rule identifies newly created cloud accounts (AWS or Google Cloud) that exhibit immediate and high-volume API activity within an hour of their creation. This pattern is indicative of resource hijacking, where attackers exploit promotional or startup cloud credits to perform unauthorized tasks, such as hosting proxied API services for resale.
Detects the initiation of an AWS Systems Manager (SSM) Session Manager session. The 'StartSession' API call is used to establish interactive remote shell sessions to managed instances (such as EC2). Monitoring this activity is critical for identifying potential remote administrative access, which could be abused for unauthorized management of cloud resources.
Detects AWS API key creation for a user by another user.
Backdoored users can be used to obtain persistence in the AWS environment.
Also with this alert, you can detect a flow of AWS keys in your org.
Backdoored users can be used to obtain persistence in the AWS environment.
Also with this alert, you can detect a flow of AWS keys in your org.
Detects the use of sts:AssumeRoot within an AWS Organization. This action allows an entity within the management account to assume root-level access in a member account, effectively bypassing standard IAM restrictions. This is a high-risk event indicative of potential privilege escalation or management account compromise.
Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken
model safety controls and allow unsafe or unauthorized model responses.
model safety controls and allow unsafe or unauthorized model responses.
Detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove
model safety controls and allow unsafe or unauthorized model responses.
model safety controls and allow unsafe or unauthorized model responses.
This rule monitors for processes making requests to cloud instance metadata services (GCP) or accessing sensitive secrets and parameters via AWS CloudTrail. Such activity may indicate an attacker attempting to enumerate instance identities, retrieve temporary security credentials, or access managed configuration secrets.
Detects the modification of an existing IAM role's trust policy to include new trusted principals (external AWS accounts, root principals, or wildcards). This technique is used for persistence and privilege escalation by modifying existing roles to allow access by an attacker-controlled principal, effectively bypassing detections focused on the creation of new roles.
This rule detects a correlation between an unauthorized IAM user access event and the subsequent execution of cryptocurrency mining tools within the same AWS account within a one-hour window. This is a strong indicator of an adversary leveraging compromised cloud credentials to perform resource hijacking.
Detects the deployment of container images in AWS ECS or EC2 via RunInstances or RegisterTaskDefinition from registries other than Amazon Elastic Container Registry (ECR) or public ECR. This rule identifies potentially unauthorized or untrusted container sources, which could indicate an adversary attempting to deploy malicious images for persistence or exploitation.
Detects unauthorized execution of AWS CLI commands within a shell spawned by Amazon Q or AWS language server processes. This activity typically involves the 'aws sts get-caller-identity' command being piped to 'curl' for remote exfiltration of cloud credentials, a behavior associated with the exploitation of CVE-2026-12957 in MCP auto-execution.
Detects anomalous activity where an identity performs a sequence of reconnaissance-related AWS API calls (e.g., listing roles, policies, or describing instances) followed shortly (within 10 minutes) by deployment actions like RunInstances or CreateCluster. This behavior is indicative of an attacker who has gained access to an identity and is surveying the environment before provisioning malicious infrastructure.
Detects modifications to AWS GuardDuty configurations, including disabling the detector, deleting publishing destinations, or altering threat intelligence sets and trusted IP lists. These actions could indicate an attempt to blind security monitoring or evade detection.
Detects potential Server-Side Template Injection (SSTI) attacks targeting the Flocci API Gateway using Velocity Template Language (VTL). The rule monitors for malicious VTL patterns in network traffic, subsequent OS command execution, anomalous file creation indicating RCE, and IAM scope bypass patterns in cloud environment logs.
Detects high-frequency S3 PutObject requests that utilize Customer-Provided Encryption Keys (SSE-C). A high count of such operations within a short window can be indicative of ransomware activity, where an adversary encrypts data within the victim's cloud storage using their own keys to prevent access by the owner.
This rule detects potential Remote Code Execution (RCE) attempts leveraging Velocity Template Language (VTL) injection vulnerabilities within AWS API Gateway. It monitors logs for specific indicators, including references to 'ProcessBuilder', malicious template artifacts, and exploitation patterns associated with the 'floci-apigateway-vtl-rce-poc' exploit.
Detects rapid, multi-type API enumeration (GetCallerIdentity, ListBuckets, DescribeInstances) performed by an IAM principal or AssumedRole that has no historical record of performing these actions. This pattern is indicative of potential credential theft, specifically from compromised developer tooling such as malicious MCP configurations or automated agents like Amazon Q, Claude Code, Cursor, or Windsurf.
This rule detects potential developer workstation compromise by monitoring for suspicious child process creation (shells/interpreters) from common development tools (Code.exe, node.exe, python.exe) followed by subsequent authentication to cloud environments (Azure, AWS, or GCP) within a 60-minute window. This behavior is indicative of a developer's machine being compromised to harvest session tokens or credentials to access cloud resources.
Detects potential identity pivoting by correlating signs of developer workstation compromise (e.g., shell spawning from IDE/node processes) with subsequent anomalous cloud console or API access from the same or associated identity within a short timeframe. This rule monitors both Azure Sign-in logs and AWS CloudTrail activity for suspicious patterns following endpoint indicators.
Detects rapid deletion and recreation of cloud storage buckets (S3 or Azure Storage) within a short timeframe (60 seconds). This behavior is often indicative of an attempt to hijack a bucket name or gain unauthorized access to data by exploiting race conditions or misconfigurations in infrastructure management.
Detects potential Velocity Template Language (VTL) injection attacks targeting API Gateway environments. The rule identifies suspicious payloads in HTTP request bodies or URLs that attempt to leverage Java-based classes (e.g., ProcessBuilder) for code execution. It also monitors for IAM scope bypass attempts, abnormal HTTP method/path combinations associated with API Gateway control-plane operations, and evidence of shell/system commands being spawned from API Gateway-related parent processes.
Page 14 of 35