Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
960 detections
Filters
Last updated
All Time
Detection languages
215
211
197
168
63
Contributors
283
142
113
112
85
Categories
670
218
168
112
95
Platforms
39,908
7,245
6,529
3,864
3,627
960
Products / Services
713
68
64
59
59
MITRE Techniques
310
305
146
136
134
CVEs
5
3
3
2
1
IDS Classtypes
13
11
11
9
8
IDS Protocols
62
1
Detects when an AWS KMS key deletion is scheduled from a source that is not identified as an Infrastructure as Code (IaC) tool (e.g., CloudFormation or Terraform). This could indicate unauthorized attempts to destroy cryptographic keys, potentially leading to data unavailability or integrity issues.
Detects when a new federation identity provider (SAML or OpenID Connect) is created or updated in AWS Identity and Access Management (IAM). This could indicate an attempt to establish new trust relationships for federated access.
This rule detects the launch of Amazon EC2 instances with GPU-enabled or very large instance types. Adversaries may launch such instances for resource-intensive tasks like cryptocurrency mining or other compute-heavy operations, which can lead to unexpected cloud costs and resource hijacking.
AWS Console Brute Force Activity
Cortex XDR
Detects repeated failed AWS console login attempts from the same IP address within a one-hour window, indicating a potential brute-force attack against AWS accounts.
This rule detects the creation of Amazon SNS (Simple Notification Service) subscriptions that are configured to send notifications to external HTTP or HTTPS endpoints. It specifically looks for `Subscribe` events from the `sns.amazonaws.com` service where the `protocol` is either `http` or `https` and the `endpoint` does not belong to Amazon's own domains (amazon.com, awsapps.com, amazonaws.com). This could indicate data exfiltration or misconfiguration where sensitive information might be sent to an unapproved external service.
AWS SES Email Enumeration Detection
Cortex XDR
Detects enumeration of AWS SES email identities and sending quotas. This activity can indicate an attacker performing reconnaissance before launching phishing or Business Email Compromise (BEC) attacks. The rule identifies multiple distinct SES operations related to identity and quota checks performed by a single user within a two-hour window.
AWS Region Enablement Detection
Cortex XDR
Detects when a commonly abused or dormant/opt-in AWS region is enabled in an account. Adversaries may enable unused AWS regions to evade detection, deploy resources for malicious activities like cryptocurrency mining, or to establish persistence outside of actively monitored regions.
Detects when a successful AWS Console Login is immediately followed by discovery actions from the same user and IP address. This pattern is indicative of an attacker performing reconnaissance after gaining initial access, as seen in recent AWS phishing campaigns.
Detects when the same AWS IAM user ARN performs actions from more than one distinct source IP within a 1-hour window. Indicative of session hijacking, credential sharing, or AiTM compromise where attacker egress IP differs from the victim's IP. AssumedRole is excluded by default due to high noise from automation — add back with tuned ARN exclusions if needed.
Detects DNS queries for domains associated with an active adversary-in-the-middle (AiTM) phishing campaign targeting AWS credentials.
This rule detects activity associated with a specific threat actor targeting FortiGate devices. It identifies network connections to known threat actor infrastructure IPs, attempts to access FortiGate management ports (443, 8443, 10443, 4443) over TCP, and successful administrative or VPN authentications from the threat actor's IPs in Fortinet/FortiGate logs. Additionally, it looks for DCSync-style directory replication access (event ID 4662) in Windows Security logs, indicating potential Active Directory compromise.
This rule detects suspicious network connections to known threat actor infrastructure associated with FortiGate exploitation, successful administrative or VPN logins to FortiGate devices from these IPs, and DCSync-style directory replication access (EventCode 4662) on Windows systems. The rule is composed of three distinct parts targeting different aspects of the attack chain.
Detects when a new AWS IAM Principal (User, Role, or Group) is created and then has a policy attached to it by the same actor within a 10-minute time frame. This sequence is a suspicious TTP often used by attackers to provision a new, privileged "shadow" account or role for persistence and lateral movement, bypassing existing accounts or role assumption paths.
Detects a sequence of events where an AWS IAM Policy is modified or created and then immediately attached to a principal (user, role, or group) within a short time window (10 minutes). This behavior is highly suspicious and often indicates a rapid privilege escalation attempt or a lateral movement step where an attacker grants themselves new permissions for immediate use.
Let's create a detection rule for "XONER dropper (multi-key
download/execution)" based on xoner.sh. The key IOCs are as follows:
- C2/Hosting: 165.232.165.152:8080
- Download path (pattern): /xoner_* (e.g., xoner_armv7l, xoner_mips,
xoner_x86_64, etc.)
- Drop file name: xoner
- Action: Save to /tmp, /dev/shm, or /var/run → chmod 777 xoner → ./xoner
xoner & execute → Delete file
Reported by Team_D4rkn3ttz
Detected by @bishop0218
download/execution)" based on xoner.sh. The key IOCs are as follows:
- C2/Hosting: 165.232.165.152:8080
- Download path (pattern): /xoner_* (e.g., xoner_armv7l, xoner_mips,
xoner_x86_64, etc.)
- Drop file name: xoner
- Action: Save to /tmp, /dev/shm, or /var/run → chmod 777 xoner → ./xoner
xoner & execute → Delete file
Reported by Team_D4rkn3ttz
Detected by @bishop0218
Let's create a detection rule for "XONER dropper (multi-key download/execution)" based on xoner.sh. The key IOCs are as follows:
- C2/Hosting: 165.232.165.152:8080
- Download path (pattern): /xoner_* (e.g., xoner_armv7l, xoner_mips, xoner_x86_64, etc.)
- Drop file name: xoner
- Action: Save to /tmp, /dev/shm, or /var/run → chmod 777 xoner → ./xoner xoner & execute → Delete file
Reported by Team_D4rkn3ttz
Detected by @bishop0218
- C2/Hosting: 165.232.165.152:8080
- Download path (pattern): /xoner_* (e.g., xoner_armv7l, xoner_mips, xoner_x86_64, etc.)
- Drop file name: xoner
- Action: Save to /tmp, /dev/shm, or /var/run → chmod 777 xoner → ./xoner xoner & execute → Delete file
Reported by Team_D4rkn3ttz
Detected by @bishop0218
The query, as constructed, is primarily focused on detecting large outbound traffic volumes to external destinations on a per source-destination pair basis within daily aggregations. Adjust the threshold and aggregation criteria based on your specific security requirements and typical network behavior patterns.
Detects TruffleHog credential validation via sts:GetCallerIdentity - initial access indicator for AWS WorkMail phishing campaigns
`This rule looks for API calls that stops logging for CloudTrail Lake channels and a trail configuration.
These actions would prevent logging of CloudTrail logs from the time of API call.
These actions would prevent logging of CloudTrail logs from the time of API call.
Detects modification of an AWS IAM role's trust policy to include a principal from an unknown or untrusted AWS account. This is a common persistence technique used by attackers to maintain access to a compromised environment by allowing their external account to assume the role.
Looking for changes of remiving the delivery channel or configuration recorder for AWS Config.
Indicative of defense evasion or someone covering their tracks.
This would stop all data such as configuration snapshots and rule compliance notifications from getting to the S3 bucket/SNS topic.
Note: Before you can delete a delivery channel, you must first stop the customer-managed configuration recorder
Indicative of defense evasion or someone covering their tracks.
This would stop all data such as configuration snapshots and rule compliance notifications from getting to the S3 bucket/SNS topic.
Note: Before you can delete a delivery channel, you must first stop the customer-managed configuration recorder
Page 29 of 46