Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
72 detections
Filters
Last updated
All Time
Detection languages
41
21
4
4
1
Contributors
40
21
5
4
1
Categories
34
15
8
8
7
Platforms
54
7
7
2
2
Products / Services
10,660
9,755
6,689
4,418
3,748
MITRE Techniques
28
17
16
11
10
CVEs
1
1
1
The following analytic detects the deletion of AWS Network Access Control Lists (ACLs). It leverages AWS CloudTrail logs to identify events where a user deletes a network ACL entry. This activity is significant because deleting a network ACL can remove critical access restrictions, potentially allowing unauthorized access to cloud instances. If confirmed malicious, this action could enable attackers to bypass network security controls, leading to unauthorized access, data exfiltration, or further compromise of the cloud environment.
The analytic identifies AWS console login events by users from a new city within the last hour. It leverages AWS CloudTrail events and compares them against a lookup file of previously seen user locations. This activity is significant for a SOC as it may indicate unauthorized access or credential compromise, especially if the login originates from an unusual location. If confirmed malicious, this could lead to unauthorized access to AWS resources, data exfiltration, or further exploitation within the cloud environment.
The following analytic detects cloud provisioning activities originating from previously unseen countries. It leverages cloud infrastructure logs and compares the geographic location of the source IP address against a baseline of known locations. This activity is significant as it may indicate unauthorized access or potential compromise of cloud resources. If confirmed malicious, an attacker could gain control over cloud assets, leading to data breaches, service disruptions, or further infiltration into the network.
The following analytic detects `StopLogging` events within AWS CloudTrail logs, a critical action that adversaries may use to evade detection. By halting the logging of their malicious activities, attackers aim to operate undetected within a compromised AWS environment. This detection is achieved by monitoring for specific CloudTrail log entries that indicate the cessation of logging activities. Identifying such behavior is crucial for a Security Operations Center (SOC), as it signals an attempt to undermine the integrity of logging mechanisms, potentially allowing malicious activities to proceed without observation. The impact of this evasion tactic is significant, as it can severely hamper incident response and forensic investigations by obscuring the attacker's actions.
The analytic identifies a spike in the number of AWS Security Hub alerts for an AWS IAM User within a 4-hour interval. It leverages AWS Security Hub findings data, calculating the average and standard deviation of alerts to detect significant deviations. This activity is significant as a sudden increase in alerts for a specific user may indicate suspicious behavior or a potential security incident. If confirmed malicious, this could signify an ongoing attack, unauthorized access, or misuse of IAM credentials, potentially leading to data breaches or further exploitation.
The following analytic identifies a spike in the number of AWS Security Hub alerts for an EC2 instance within a 4-hour interval. It leverages AWS Security Hub findings data, calculating the average and standard deviation of alerts to detect anomalies. This activity is significant for a SOC as a sudden increase in alerts may indicate potential security incidents or misconfigurations requiring immediate attention. If confirmed malicious, this could signify an ongoing attack, leading to unauthorized access, data exfiltration, or disruption of services on the affected EC2 instance.
This analytic detects the execution of the 'shred' command on a Linux machine, which is used to overwrite files to make them unrecoverable. It leverages data from Linux Auditd, focusing on process names and command-line arguments. This activity is significant because the 'shred' command can be used in destructive attacks, such as those seen in the Industroyer2 malware targeting energy facilities. If confirmed malicious, this activity could lead to the permanent destruction of critical files, severely impacting system integrity and data availability.
The analytic identifies high-risk activities within repositories by correlating repository data with risk scores. It leverages risk events from the Dev Sec Ops analytic stories, summing risk scores and capturing source and user information. The detection focuses on high-risk scores above 100 and sources with more than three occurrences. This activity is significant as it highlights repositories frequently targeted by threats, providing insights into potential vulnerabilities. If confirmed malicious, attackers could exploit these repositories, leading to data breaches or infrastructure compromise.
This rule detects cryptocurrency mining activity within Amazon EC2, AWS Lambda, or Amazon EKS Runtimes, as reported by AWS GuardDuty. It specifically looks for GuardDuty findings related to 'CryptoCurrency', 'CryptoMinerExecuted', or 'BitcoinDomainRequest' and filters out sample findings.
Detects when an AWS GuardDuty detector is disabled or suspended. This can indicate an adversary attempting to impair defenses to avoid detection.
This rule detects when a GuardDuty Detector's publishing destination has been deleted. GuardDuty is an AWS threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect AWS accounts and workloads. Deleting its publishing destination prevents GuardDuty from exporting its findings, effectively impairing the organization's ability to detect and respond to security incidents. This action could be performed by an attacker attempting to hide their activities or by an insider aiming to reduce security visibility.
This rule detects Denial of Service (DoS) activity originating from an Amazon EC2 instance, as identified by AWS GuardDuty. It specifically looks for GuardDuty findings where the product event type indicates a DenialOfService event and filters out any sample findings.
This rule detects when an Amazon EC2 instance or a container attempts to communicate with a black hole IP address, as reported by AWS GuardDuty. Black hole IP addresses are typically used to sinkhole malicious traffic or are unroutable, indicating potentially suspicious or misconfigured outbound communication from a compromised or misbehaving resource.
This rule detects brute force activity targeting Amazon EC2 or Amazon RDS instances, as reported by AWS GuardDuty. It specifically looks for GuardDuty findings where the product event type contains 'BruteForce' and filters out sample findings.
This rule detects when Amazon GuardDuty identifies an Amazon EC2 instance or a container querying algorithmically generated domains (DGA). DGA activity is often indicative of malware attempting to establish command and control (C2) communication with its operators. The rule specifically looks for GuardDuty findings with the product event type 'DGADomainRequest' and filters out sample findings.
Detects when an AWS GuardDuty Detector's trusted IP lists or threat intelligence IP lists are deleted or disabled. This activity could indicate an adversary attempting to impair defensive capabilities to avoid detection.
This rule detects when Amazon GuardDuty identifies a malicious or suspicious file being executed on an Amazon EC2 instance or a container workload. It specifically looks for GuardDuty findings with product event types 'MaliciousFile' or 'SuspiciousFile', excluding any sample findings.
This rule detects activity associated with the Tor network within an AWS account, as identified by AWS GuardDuty. It specifically looks for GuardDuty findings related to TorIPCaller, TorRelay, or TorClient, indicating potential use of Tor for anonymization or command and control.
This rule detects Command and Control (C2) activity identified by AWS GuardDuty across Amazon EC2, AWS Lambda, or Amazon EKS Runtimes. It specifically looks for GuardDuty findings with a product event type matching 'C&CActivity' and filters out sample findings. The rule aims to alert on suspicious communication patterns that indicate an adversary is controlling compromised resources within the AWS environment.
This rule detects penetration testing activity originating from known offensive security distributions like Kali Linux, Parrot Linux, or Pentoo Linux, as identified by Amazon GuardDuty. The detection is based on GuardDuty findings that specifically indicate 'PenTest' activity.
Amazon GuardDuty detects penetration testing activity from known offensive security distros such as KaliLinux, ParrotLinux or PentooLinux.
Page 3 of 4