Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
960 detections
Filters
Last updated
All Time
Detection languages
215
211
197
168
63
Contributors
283
142
113
112
85
Categories
670
218
168
112
95
Platforms
39,908
7,245
6,529
3,864
3,627
960
Products / Services
713
68
64
59
59
MITRE Techniques
310
305
146
136
134
CVEs
5
3
3
2
1
IDS Classtypes
13
11
11
9
8
IDS Protocols
62
1
Detects unauthorized sharing, copying, or exporting of EBS, disk, or database snapshots to external cloud accounts, subscriptions, or projects that are not present in the defined trusted allow-list for AWS, Azure, or GCP environments.
Detects attempts by a principal to modify, stop, or delete AWS CloudTrail logging configurations. Such activity is a common indicator of defense evasion during the early stages of a cloud-based attack to prevent audit trail capture.
Detects high-volume or multi-type destructive operations against cloud backup, snapshot, and recovery infrastructure, including the disabling of immutability policies or soft-delete protections. This activity is consistent with ransomware actors attempting to eliminate recovery options before encrypting data.
This rule detects scenarios where an existing SSO or Identity Provider (IdP) session is reused from a device context that differs from the one that originally performed MFA. It identifies this by joining authentication events by SessionId, specifically looking for instances where MFA occurred in one event and a subsequent non-MFA event for the same session has a different User-Agent, DeviceId, JA3 hash, or Operating System build, indicating potential session token theft or reuse.
Detects administrative IAM operations such as user, role, or access key creation performed by an identity containing 'agent' in its ARN or username. This behavior is intended to flag unauthorized privilege escalation or persistence mechanisms initiated by automated service identities that should not be modifying IAM configurations.
Detects anomalous AWS Bedrock model invocation patterns where a single identity accesses models across three or more distinct AWS regions within a short timeframe. This behavior is indicative of quota evasion, where attackers bypass per-region rate limits to maximize throughput when leveraging compromised credentials for unauthorized LLM use.
This rule detects administrative changes to cloud storage configurations (AWS S3, Azure Blob, and GCP Storage) that result in public or anonymous read/write access to buckets or containers, which could lead to unauthorized data exposure.
Detects unauthorized or suspicious modifications to audit and logging configurations across AWS, Azure, and GCP. The rule identifies actions such as stopping, deleting, or updating logging trails, diagnostic settings, or logging sinks, which may indicate an adversary attempting to impair visibility into their activities (Anti-Forensics).
Detects the creation of high-cost, resource-intensive compute instances (such as GPU-enabled or large-scale VMs) within cloud regions that have not been previously utilized by the account, subscription, or project. This behavior is often indicative of unauthorized resource hijacking, such as crypto-mining or large-scale data processing by threat actors.
Detects the creation or modification of serverless functions (AWS Lambda, Azure Function Apps, GCP Cloud Functions) that exhibit high-risk configurations. These include functions assigned overly permissive IAM roles, configured for public or unauthenticated invocation, or tied to event triggers commonly abused for persistence in cloud environments.
This rule detects the creation or modification of identity federation trust configurations across multiple cloud platforms (AWS, Azure AD, GCP). Attackers often modify trust relationships to establish persistence, forge credentials, or escalate privileges by introducing malicious identity providers (SAML/OIDC) that grant unauthorized access to the environment.
Detects the initialization of an AWS CloudShell environment or session. Attackers often abuse CloudShell as a managed, agentless environment within the provider's infrastructure to stage tools, perform reconnaissance using the AWS CLI, and exfiltrate data while bypassing standard endpoint-based detection.
Detects unauthorized attempts to modify or delete AWS CloudTrail logs stored in S3, or changes to the S3 bucket lifecycle configuration that would shorten the log retention period. This activity is indicative of an adversary attempting to clear their tracks or hinder audit capabilities.
Detects instances where a principal utilizes the iam:PassRole permission to assign a role with higher privileges to a newly created or updated compute resource (Lambda or EC2), potentially allowing the principal to assume the identity and elevated permissions of the passed role.
Detects modifications to SAML identity providers, federation settings, and trust configurations in AWS and Azure AD/Entra where the signing certificate fingerprint does not match a known-good baseline, and no corresponding change ticket is detected in the raw logs.
Detects modifications to federated domain authentication, identity provider trusts, or federation settings in cloud environments (e.g., Entra ID, Okta). Unauthorized changes to these configurations can be used to establish persistence, enable SAML token forgery, or bypass Multi-Factor Authentication (MFA).
Detects anomalous sign-in activity for service principals (non-interactive accounts) where the same application authenticates from multiple distinct countries within a 24-hour window. This behavior often indicates the unauthorized use of compromised service principal credentials, such as client secrets or certificates, from distributed attacker-controlled infrastructure.
Detects instances where an IAM user or role attempts to assume a role in a different AWS account (Cross-Account) without providing a valid ExternalID. This often indicates unauthorized attempts to access or abuse cross-account trust relationships, which is a common technique for lateral movement or privilege escalation in cloud environments.
Detects AWS CloudTrail events where an actor performs identity or session token manipulation, specifically through the use of sts:GetFederationToken or sts:AssumeRole, or by modifying MFA configurations such as DeactivateMFADevice or CreateVirtualMFADevice on privileged accounts. This activity may indicate an attempt to gain persistent access, bypass security controls, or masquerade as a legitimate principal.
The following analytic detects the creation of cloud compute instances using previously unseen image IDs. It leverages cloud infrastructure logs to identify new image IDs that have not been observed before. This activity is significant because it may indicate unauthorized or suspicious activity, such as the deployment of malicious payloads or unauthorized access to sensitive information. If confirmed malicious, this could lead to data breaches, unauthorized access, or further compromise of the cloud environment. Immediate investigation is required to determine the legitimacy of the instance creation and to mitigate potential threats.
The following analytic detects the creation of EC2 instances with previously unseen instance types.
It leverages Splunk's tstats command to analyze data from the Change data model, identifying instance types that have not been previously recorded.
This activity is significant for a SOC because it may indicate unauthorized or suspicious activity, such as an attacker attempting to create instances for malicious purposes.
If confirmed malicious, this could lead to unauthorized access, data exfiltration, system compromise, or service disruption. Immediate investigation is required to determine the legitimacy of the instance creation.
It leverages Splunk's tstats command to analyze data from the Change data model, identifying instance types that have not been previously recorded.
This activity is significant for a SOC because it may indicate unauthorized or suspicious activity, such as an attacker attempting to create instances for malicious purposes.
If confirmed malicious, this could lead to unauthorized access, data exfiltration, system compromise, or service disruption. Immediate investigation is required to determine the legitimacy of the instance creation.
Page 3 of 46