Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
734 detections
Filters
Last updated
All Time
Detection languages
195
188
140
128
53
Contributors
229
147
111
94
34
Categories
613
214
127
93
73
Platforms
713
77
57
26
26
Products / Services
10,665
9,758
6,692
4,418
3,749
734
MITRE Techniques
294
276
143
124
106
CVEs
3
1
1
1
IDS Classtypes
5
5
4
2
IDS Protocols
16
Detects cloud disk snapshot creation potentially for data exfiltration
Detects a multi-stage attack where an adversary reads local AWS credentials or configuration files (e.g., .aws/credentials, mcp.json) on a developer workstation and subsequently performs unauthorized AWS API calls from the same source IP. The rule correlates initial credential access on the endpoint with a sequence of AWS CloudTrail events starting with identity verification (GetCallerIdentity) followed by enumeration and potentially high-impact API calls (e.g., RunInstances, AssumeRole).
Detects a sequence of events where a developer utility (e.g., npm, git) is executed on an endpoint, followed shortly by suspicious cloud API calls originating from the same source IP address. This pattern potentially indicates credential theft or misuse where keys or configuration files were exfiltrated or abused to authenticate against AWS services.
Detects assignment of high-privileged cloud admin roles for persistence
Detects the execution of remote commands on cloud virtual machines (Azure RunCommand or AWS SSM SendCommand) during defined off-hours (18:00 to 06:00). This rule identifies potentially unauthorized administrative or management activity occurring outside of standard business hours across cloud environments.
Detects high-frequency S3 PutObject requests that utilize Customer-Provided Encryption Keys (SSE-C). A high count of such operations within a short window can be indicative of ransomware activity, where an adversary encrypts data within the victim's cloud storage using their own keys to prevent access by the owner.
Detects the execution of 'aws sts get-caller-identity' spawned by IDE-related processes such as VS Code extension hosts or Amazon Q language servers. This pattern may indicate cloud credential reconnaissance performed by a malicious MCP (Model Context Protocol) server or compromised development extension (CVE-2026-12957).
Detects attackers querying audit logs to understand defender visibility
This rule detects potentially suspicious AWS API activity by identifying IAM identities that perform high-privilege operations or use developer-oriented user agents (e.g., boto3, python-requests) from multiple distinct IP addresses within a one-hour window. It calculates a risk score based on the combination of source IP diversity, developer tool usage, and the presence of sensitive API calls such as CreateUser, CreateAccessKey, RunInstances, and AssumeRole.
This rule detects suspicious activities related to AWS S3 buckets that could indicate a bucket hijacking attempt or unauthorized replication to an external account. Specifically, it looks for two scenarios: 1) an S3 bucket being deleted and then recreated by a different AWS account within a one-hour window, suggesting a namespace hijacking, or 2) an S3 bucket being deleted while a PutBucketReplication event references an external AWS account, indicating an attempt to exfiltrate data or maintain access through replication.
This rule detects a potential AWS S3 bucket name hijacking scenario. It looks for instances where an S3 bucket is deleted and then a new bucket with the exact same name is created within a short time frame (up to 1 hour) by a *different* AWS account. This pattern can be used to hijack S3 replication rule destinations, enabling silent data exfiltration to an attacker-controlled account. The rule also attempts to identify if the original bucket had replication configured.
Detects rapid deletion and recreation of cloud storage buckets (S3 or Azure Storage) within a short timeframe (60 seconds). This behavior is often indicative of an attempt to hijack a bucket name or gain unauthorized access to data by exploiting race conditions or misconfigurations in infrastructure management.
Detects anomalous AWS API activity immediately following a successful ConsoleLogin event for the same user. This behavior is indicative of a session replay attack, often associated with AiTM phishing kits like PoisonSeeds, where a victim's session cookie is harvested and immediately reused by an attacker to programmatically access the AWS environment.
Detects anomalous authentication behavior consistent with an Adversary-in-the-Middle (AiTM) attack, where a single user account triggers multiple MFA challenge requests from distinct source IP addresses within a two-minute window. This behavior is indicative of an adversary proxying authentication requests in real-time between the user and a legitimate service.
Detects suspicious sequences of AWS CloudTrail API calls originating from non-console or non-service-account sources (CLI, curl, etc.). The rule flags scenarios where reconnaissance via 'GetCallerIdentity' is immediately followed by sensitive IAM modifications (CreateUser, CreateAccessKey) or privilege escalation attempts (AssumeRole), which may indicate the use of exfiltrated credentials.
Detects execution of AWS CLI subcommands used for credential or identity enumeration (e.g., sts get-caller-identity, iam get-user) when spawned from Amazon Q-related or development environment processes (Node.js/VS Code). This behavior is indicative of potential malicious activity involving a compromised MCP server configuration file (CVE-2026-12957).
Detects a sequence of events where a cloud storage bucket is deleted and then immediately recreated with the same name. This pattern is indicative of a potential bucket hijacking attack, where an adversary attempts to take ownership of a bucket to intercept data streams, such as logging sinks, application data, or replication traffic.
Detects anomalous AWS API activity following a console login where the API calls originate from a different IP address within 10 minutes, potentially indicating the replay of stolen session tokens captured via Adversary-in-the-Middle (AiTM) techniques.
Detects broad assignments of administrative roles or specific deletion permissions for cloud storage buckets in GCP, AWS, and Azure. This includes granting 'storage.admin', 'storage.objectAdmin', or 'storage.buckets.delete' in GCP, 's3:DeleteBucket' in AWS IAM policies, or 'Storage Account Contributor'/'Owner' roles in Azure. Such assignments to service accounts or non-administrative identities could enable 'Universal Bucket Hijacking' or unauthorized data deletion.
Detects the use of the AWS CLI to extract Secrets Manager values and potentially STS tokens, writing them to local text files in the /tmp directory. This activity is indicative of an attacker attempting to exfiltrate credentials or sensitive information.
Detects a potential S3 bucket hijacking attempt where a bucket is deleted by one AWS account and subsequently recreated by a different AWS account within a 30-minute window. This behavior could indicate an attempt to intercept cross-account replication or misdirected data flows.
Page 15 of 35