Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
960 detections
Filters
Last updated
All Time
Detection languages
215
211
197
168
63
Contributors
283
142
113
112
85
Categories
670
218
168
112
95
Platforms
39,915
7,245
6,529
3,864
3,627
960
Products / Services
713
68
64
59
59
MITRE Techniques
310
305
146
136
134
CVEs
5
3
3
2
1
IDS Classtypes
13
11
11
9
8
IDS Protocols
62
1
This rule detects various event types (email, identity authentication, network connections, and cloud audit logs) originating from or interacting with the specific IP address range 160.79.104.0/22 to 160.79.111.0/22, which is associated with known malicious activity.
Detects Server-Side Request Forgery (SSRF) attempts originating from the Grafana MCP (Model Context Protocol) process. The rule specifically monitors for instances where the 'grafana_api_request' tool is used in conjunction with a 'X-Grafana-URL' header targeting cloud metadata IP ranges (169.254.0.0/16), or where the host attempts to resolve GCP metadata domains ('metadata.google.internal'). This behavior is indicative of an attacker attempting to access cloud provider instance metadata to exfiltrate security credentials.
Detects the creation of new AWS access keys or login profiles for a target identity immediately following the deletion or modification of a credential for the same identity, where the actors performing the two actions are different. This pattern indicates an adversary creating persistent access after a security incident responder or automated system has revoked a previously compromised credential.
This rule detects potential cloud service enumeration activity originating from a specific, potentially malicious IP address (23.234.84.102). It flags instances where this source IP performs specific API calls ('GetCallerIdentity' and 'ListTopics') without expected user-agent strings typical of legitimate AWS service traffic.
This rule detects potential cloud service enumeration activity originating from a specific, potentially malicious IP address (23.234.84.102). It flags instances where this source IP performs specific API calls ('GetCallerIdentity' and 'ListTopics') without expected user-agent strings typical of legitimate AWS service traffic.
This rule detects potential cloud service enumeration activity originating from a specific, potentially malicious IP address (23.234.84.102). It flags instances where this source IP performs specific API calls ('GetCallerIdentity' and 'ListTopics') without expected user-agent strings typical of legitimate AWS service traffic.
Detects multiple AWS API calls (Publish, GetCallerIdentity, ListTopics) originating from a specific IP address (23.234.84.102) associated with a Zapier SNS sender. This rule monitors for potentially unauthorized or anomalous API usage patterns by identifying repeated, successful, and non-error events from a known source that may indicate misuse or compromise of an integration account.
Detects multiple AWS API calls (Publish, GetCallerIdentity, ListTopics) originating from a specific IP address (23.234.84.102) associated with a Zapier SNS sender. This rule monitors for potentially unauthorized or anomalous API usage patterns by identifying repeated, successful, and non-error events from a known source that may indicate misuse or compromise of an integration account.
Detects multiple AWS API calls (Publish, GetCallerIdentity, ListTopics) originating from a specific IP address (23.234.84.102) associated with a Zapier SNS sender. This rule monitors for potentially unauthorized or anomalous API usage patterns by identifying repeated, successful, and non-error events from a known source that may indicate misuse or compromise of an integration account.
Detects multiple AWS API calls (Publish, GetCallerIdentity, ListTopics) originating from a specific IP address (23.234.84.102) associated with a Zapier SNS sender. This rule monitors for potentially unauthorized or anomalous API usage patterns by identifying repeated, successful, and non-error events from a known source that may indicate misuse or compromise of an integration account.
This rule detects attempts to exploit the LiteLLM proxy pass-through endpoint to interact with the cloud Instance Metadata Service (IMDS). Specifically, it identifies configuration attempts to route traffic to the IMDS IP (169.254.169.254) and subsequent requests to retrieve IAM security credentials, which is indicative of a Server-Side Request Forgery (SSRF) attack to steal cloud identity tokens.
This rule correlates email sender activity with network, cloud, and identity logs by matching traffic against a specific IP range (160.79.104.0/21) identified as malicious or suspicious. The rule flags instances where this range appears as an email sender IP or as a remote/source IP address across various infrastructure indices, potentially indicating adversary communication or exfiltration.
This rule detects various event types (email, identity authentication, network connections, and cloud audit logs) originating from or interacting with the specific IP address range 160.79.104.0/22 to 160.79.111.0/22, which is associated with known malicious activity.
Detects rapid, sequential identity-validation API calls (such as GetCallerIdentity, GetSessionToken, or AssumeRole) performed across a large number of distinct AWS access keys from a single source within a short time window. This pattern is indicative of automated tooling validating a harvested corpus of AWS access keys to identify active credentials.
Detects rapid, sequential identity-validation API calls (such as GetCallerIdentity, GetSessionToken, or AssumeRole) performed across a large number of distinct AWS access keys from a single source within a short time window. This pattern is indicative of automated tooling validating a harvested corpus of AWS access keys to identify active credentials.
Detects instances where a large volume of data (greater than 5GB) is transferred through an anonymous proxy using specific cloud application IDs. This pattern is indicative of potential data exfiltration via third-party or obscured network channels.
Detects the creation of a new AWS S3 bucket followed by a large volume of data uploads (more than 200 objects) within a 2-hour window. The detection focuses on activity attributed to a single identity with limited source IP diversity, which is highly indicative of scripted data staging and potential exfiltration preparation by an unauthorized actor.
This rule correlates email sender activity with network, cloud, and identity logs by matching traffic against a specific IP range (160.79.104.0/21) identified as malicious or suspicious. The rule flags instances where this range appears as an email sender IP or as a remote/source IP address across various infrastructure indices, potentially indicating adversary communication or exfiltration.
This rule correlates email sender activity with network, cloud, and identity logs by matching traffic against a specific IP range (160.79.104.0/21) identified as malicious or suspicious. The rule flags instances where this range appears as an email sender IP or as a remote/source IP address across various infrastructure indices, potentially indicating adversary communication or exfiltration.
This rule detects various event types (email, identity authentication, network connections, and cloud audit logs) originating from or interacting with the specific IP address range 160.79.104.0/22 to 160.79.111.0/22, which is associated with known malicious activity.
This rule detects successful user authentication events within the environment. It acts as a base filter to capture login success, which can be further refined with context such as IP addresses or usernames to monitor for anomalous login patterns, though it does not inherently provide detection of complex attacks like session token hijacking on its own.
Page 15 of 46