Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
734 detections
Filters
Last updated
All Time
Detection languages
195
188
140
128
53
Contributors
229
147
111
94
34
Categories
613
214
127
93
73
Platforms
713
77
57
26
26
Products / Services
10,660
9,755
6,689
4,418
3,748
734
MITRE Techniques
294
276
143
124
106
CVEs
3
1
1
1
IDS Classtypes
5
5
4
2
IDS Protocols
16
The following analytic detects the deletion of an IAM policy in AWS. It leverages AWS CloudTrail logs to identify `DeletePolicy` events, excluding those from AWS internal services. This activity is significant as unauthorized policy deletions can disrupt access controls and weaken security postures. If confirmed malicious, an attacker could remove critical security policies, potentially leading to privilege escalation, unauthorized access, or data exfiltration. Monitoring this behavior helps ensure that only authorized changes are made to IAM policies, maintaining the integrity and security of the AWS environment.
The analytic detects when a user sets a default policy version in AWS. It leverages AWS CloudTrail logs to identify the `SetDefaultPolicyVersion` event from the IAM service. This activity is significant because attackers may exploit this technique for privilege escalation, especially if previous policy versions grant more extensive permissions than the current one. If confirmed malicious, this could allow an attacker to gain elevated access to AWS resources, potentially leading to unauthorized actions and data breaches.
The analytic detects an AWS CloudTrail event where a user with permissions updates the login profile of another user. It leverages CloudTrail logs to identify instances where the user making the change is different from the user whose profile is being updated. This activity is significant because it can indicate privilege escalation attempts, where an attacker uses a compromised account to gain higher privileges. If confirmed malicious, this could allow the attacker to escalate their privileges, potentially leading to unauthorized access and control over sensitive resources within the AWS environment.
The following analytic identifies the creation of AWS IAM access keys by a user for another user, which can indicate privilege escalation. It leverages AWS CloudTrail logs to detect instances where the user creating the access key is different from the user for whom the key is created. This activity is significant because unauthorized access key creation can allow attackers to establish persistence or exfiltrate data via AWS APIs. If confirmed malicious, this could lead to unauthorized access to AWS services, data exfiltration, and long-term persistence in the environment.
The following analytic identifies low, informational, or unknown severity findings from AWS Elastic Container Registry (ECR) image scans. It leverages AWS CloudTrail logs, specifically the DescribeImageScanFindings event, to detect these findings. This activity is significant for a SOC as it helps in early identification of potential vulnerabilities or misconfigurations in container images, which could be exploited if left unaddressed. If confirmed malicious, these findings could lead to unauthorized access, data breaches, or further exploitation within the containerized environment.
This analytic identifies failed attempts to delete AWS IAM groups. It leverages AWS CloudTrail logs to detect events where the DeleteGroup action fails due to errors like NoSuchEntityException, DeleteConflictException, or AccessDenied. This activity is significant as it may indicate unauthorized attempts to modify IAM group configurations, which could be a precursor to privilege escalation or other malicious actions. If confirmed malicious, this could allow an attacker to disrupt IAM policies, potentially leading to unauthorized access or denial of service within the AWS environment.
The following analytic identifies the successful deletion of an IAM group in AWS. It leverages CloudTrail logs to detect `DeleteGroup` events with a success status. This activity is significant as it could indicate potential changes in user permissions or access controls, which may be a precursor to further unauthorized actions. If confirmed malicious, an attacker could disrupt access management, potentially leading to privilege escalation or unauthorized access to sensitive resources. Analysts should review related IAM events, such as recent user additions or new group creations, to assess the broader context.
The analytic detects `StopLogging` events in AWS CloudTrail logs. It identifies when logging is intentionally stopped, excluding console-based actions and focusing on successful attempts. This activity is significant because adversaries may stop logging to evade detection and operate stealthily within the compromised environment. If confirmed malicious, this action could allow attackers to perform further activities without being logged, hindering incident response and forensic investigations, and potentially leading to unauthorized access or data exfiltration.
The analytic identifies medium-severity findings from AWS Elastic Container Registry (ECR) image scans. It leverages AWS CloudTrail logs, specifically the DescribeImageScanFindings event, to detect vulnerabilities in container images. This activity is significant for a SOC as it highlights potential security risks in containerized applications, which could be exploited if not addressed. If confirmed malicious, these vulnerabilities could lead to unauthorized access, data breaches, or further exploitation within the container environment, compromising the overall security posture.
The following analytic detects the deletion of AWS Network Access Control Lists (ACLs). It leverages AWS CloudTrail logs to identify events where a user deletes a network ACL entry. This activity is significant because deleting a network ACL can remove critical access restrictions, potentially allowing unauthorized access to cloud instances. If confirmed malicious, this action could enable attackers to bypass network security controls, leading to unauthorized access, data exfiltration, or further compromise of the cloud environment.
Detects when a user attaches a Lambda layer to an existing AWS Lambda function. A malicious Lambda layer could execute arbitrary code in the context of the function's IAM role, potentially granting an adversary access to resources the function has access to. This activity could indicate privilege escalation or unauthorized modification of serverless functions.
Detects when a user attached a Lambda layer to an existing Lambda function.
A malicious Lambda layer could execute arbitrary code in the context of the function's IAM role.
This would give an adversary access to resources that the function has access to.
A malicious Lambda layer could execute arbitrary code in the context of the function's IAM role.
This would give an adversary access to resources that the function has access to.
Detects API calls originating from AWS accounts that are not part of the organization, based on a reference list of approved AWS account IDs. This could indicate unauthorized access or activity from external entities.
This rule detects when an AWS Config Service is modified, stopped, or deleted. Specifically, it looks for CloudTrail events indicating actions such as stopping or deleting a configuration recorder, deleting a delivery channel, or putting (creating/updating) a delivery channel or configuration recorder. These actions can be indicative of an adversary attempting to impair defenses by disabling or modifying cloud logging capabilities.
This rule detects when an AWS account attempts to leave an AWS organization or is removed from an AWS organization. This activity can indicate an adversary attempting to evade detection or disrupt cloud infrastructure by isolating an account from central management and security policies.
This rule detects successful logins to the AWS console where Multi-Factor Authentication (MFA) was not used. It specifically looks for 'ConsoleLogin' events from AWS CloudTrail with an 'ALLOW' action and where 'MFAUsed' is explicitly set to 'No'. The rule also increases the risk score if the login is performed by a 'Root' user.
Detects when a high number of failed authentication attempts occur for unknown users on AWS, indicating a potential brute-force or credential stuffing attack against the AWS console.
Detects when the AWS managed policy 'AWSCompromisedKeyQuarantine' is attached to an IAM user, role, or group. This policy is typically applied by AWS when credentials for an IAM entity are suspected of being compromised or publicly exposed, indicating a potential security incident.
This rule detects successful AWS API calls originating from an IP address identified as a Tor exit node. It leverages a GCTI Feed for Tor exit node IP listings and also calculates a risk score based on the geographical location of the originating IP, specifically increasing the score for connections from Cuba, Iran, North Korea, Russia, and Syria.
Detects when an IAM user attempts to update or modify the code of an AWS Lambda function. This activity can be indicative of an attacker trying to introduce malicious code, backdoor existing functions, or alter their behavior for persistence, privilege escalation, or other malicious purposes.
This rule detects a successful login to the AWS console after multiple failed login attempts for the same user within a 15-minute window. It specifically looks for at least three failed authentication attempts followed by one successful authentication. The rule also calculates a risk score based on potential country mismatches between failed and successful attempts, and successful logins from unauthorized geographies (Cuba, Iran, North Korea, Russia, Syria).
Page 29 of 35