Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
734 detections
Filters
Last updated
All Time
Detection languages
195
188
140
128
53
Contributors
229
147
111
94
34
Categories
613
214
127
93
73
Platforms
713
77
57
26
26
Products / Services
10,665
9,758
6,692
4,418
3,749
734
MITRE Techniques
294
276
143
124
106
CVEs
3
1
1
1
IDS Classtypes
5
5
4
2
IDS Protocols
16
Detects consecutive successful AWS ConsoleLogin events for the same user originating from distinct IP addresses within a 10-minute window. This behavior is indicative of a session-based attack such as Adversary-in-the-Middle (AiTM) where session cookies are intercepted and replayed, allowing an attacker to bypass traditional authentication or multi-factor authentication controls.
Detects the execution of remote commands on cloud virtual machines (Azure RunCommand or AWS SSM SendCommand) during defined off-hours (18:00 to 06:00). This rule identifies potentially unauthorized administrative or management activity occurring outside of standard business hours across cloud environments.
Detects reversion of cloud instances to snapshots to remove evidence
This rule detects suspicious activities involving AWS CLI or curl commands spawned from IDE-related processes (amazonq-language-server, Code.exe). It monitors for command patterns indicating credential discovery (aws sts get-caller-identity) or data exfiltration (curl POST requests), and correlates these with unusual CloudTrail GetCallerIdentity events occurring from non-AWS source IP addresses.
Detects the deletion of a storage bucket immediately followed by the creation of a new bucket with the same name across different cloud providers (GCP, AWS S3, Azure). This rule specifically flags scenarios where the deleting actor or project differs from the creating actor or project, indicating a potential cross-account hijack or data exfiltration attempt.
Detects a potential S3 bucket hijacking attempt where an S3 bucket is deleted and shortly after, an AWS Firehose delivery stream is created or updated to target a bucket with the same name, but under a different AWS account. This could indicate an adversary attempting to exfiltrate data by redirecting data intended for the original bucket to their own controlled bucket.
This rule detects suspicious activities related to AWS S3 buckets that could indicate a bucket hijacking attempt or unauthorized replication to an external account. Specifically, it looks for two scenarios: 1) an S3 bucket being deleted and then recreated by a different AWS account within a one-hour window, suggesting a namespace hijacking, or 2) an S3 bucket being deleted while a PutBucketReplication event references an external AWS account, indicating an attempt to exfiltrate data or maintain access through replication.
Detects a sequence of events where an Amazon S3 bucket is deleted, followed within one hour by the creation of an Amazon Data Firehose delivery stream or an update to a destination using the same bucket name. This pattern indicates a potential bucket name hijacking attempt, where an attacker recreates the deleted bucket to intercept or redirect data streams processed by Firehose.
Detects unauthenticated or anonymous access attempts to cloud storage buckets, specifically targeting Azure Blob Storage and AWS S3. The rule identifies access to publicly exposed buckets or those with anonymous access enabled, including specific bucket names associated with known OPSEC failures (pois43, w456w5, sentiwaw). This could indicate data exposure or reconnaissance by unauthorized actors.
Detects CI/CD runner agents calling 'aws configure list-profiles' and connecting to a known malicious IP address (216.126.225.129), as prescribed by the Megalodon CI/CD malware.
Detects retrieval of secrets from AWS Secrets Manager
Detects retrieval of secrets from AWS Secrets Manager
Detects unauthorized processes reading the .bash_history file concurrently with AWS CLI activity, which could indicate an adversary attempting to extract credentials or sensitive information from command history while interacting with AWS services. This behavior is associated with the Megalodon CI/CD malware.
Detects creation of additional IAM access keys for cloud account persistence
Detects deletion of cloud security group rules to weaken network security
Detects bulk AWS API calls for cloud infrastructure discovery
Detects cloud services being used to move laterally between cloud resources
Detects bulk AWS API calls for cloud infrastructure discovery
This rule detects attempts to disable AWS CloudTrail logging via the AWS API. It specifically looks for HTTP requests to 'cloudtrail.amazonaws.com' with 'StopLogging' in the URI, indicating an attempt to stop CloudTrail from recording API activity.
Detects modification of AWS organizational units to evade policy controls
Detects cloud instance creation in unusual regions for evasion
Page 16 of 35