Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
960 detections
Filters
Last updated
All Time
Detection languages
215
211
197
168
63
Contributors
283
142
113
112
85
Categories
670
218
168
112
95
Platforms
39,908
7,245
6,529
3,864
3,627
960
Products / Services
713
68
64
59
59
MITRE Techniques
310
305
146
136
134
CVEs
5
3
3
2
1
IDS Classtypes
13
11
11
9
8
IDS Protocols
62
1
This rule detects successful 'GetObject' operations on AWS S3 buckets originating from external IP addresses (not within common private IP ranges). This could indicate an attempt to exfiltrate data from S3 buckets by an unauthorized entity or compromised credential.
This rule detects attempts to delete S3 bucket logging configurations originating from IP addresses not associated with AWS infrastructure. This could indicate an attacker attempting to cover their tracks by disabling logging for an S3 bucket after gaining unauthorized access.
High AWS S3 Object Deletion Count
Cortex XDR
Detects when a single IP address or identity performs a high number of S3 object or bucket deletions within a short timeframe. This could indicate an attacker attempting to destroy data, evade detection, or disrupt services.
Detects a sequence of events where an AWS IAM Role Trust Policy or a Role's managed policy is modified (UpdateAssumeRolePolicy, PutRolePolicy) and is immediately followed by a successful assumption of that role (AssumeRole, AssumeRoleWithSAML, etc.) within a 10-minute window. This behavior is characteristic of an attacker setting up a backdoor or escalating privileges by granting a new, unauthorized principal (user, service, or account) permission to assume a critical role.
This rule detects Amazon S3 PutObject events where server-side encryption is performed using SSE-C (Server-Side Encryption with Customer-Provided Keys) or where the request uses Signature Version 2 (SigV2). SSE-C relies on the customer to manage encryption keys, which can introduce risks if not handled securely. SigV2 is an older, less secure authentication protocol for AWS requests and its use is generally discouraged in favor of SigV4.
Detects attempts to tamper with AWS CloudTrail or GuardDuty logging configurations by monitoring specific API calls that can disable, modify, or delete logging mechanisms. This includes actions like stopping logging, deleting trails, updating trails, disassociating from master accounts, archiving findings, stopping member monitoring, and deleting or updating detectors. Successful execution of these actions without an error indicates potential malicious activity aimed at evading detection.
Detects AWS IAM roles whose trust policies were newly created or updated to allow cross account AWS principals to assume the role without any confused deputy protections in place.
Detects anomalous increases in AWS API calls resulting in "AccessDenied" errors for a single identity and source IP address, relative to that identity's historical baseline over the past 30 days. Sudden increases in denied requests or the variety of APIs being denied may indicate reconnaissance, permission probing, or misconfigured automation attempts by an adversary.
Detects when an AWS IAM role is assumed by an identity that has not used that specific role within a historical 7-day window. This behavior can indicate lateral movement, privilege escalation, compromised credentials, or a deviation from normal workload patterns. The rule excludes AWS internal service identities to focus on human and workload actors.
Detects the creation or modification of an IAM Role trust policy that grants assume-role permissions to an AWS account that is not part of the organization. This action creates a backdoor for an external entity to gain persistent access to your environment, often used by attackers to maintain unauthorized access. This rule relies on an `aws_org_accounts.csv` lookup table to identify accounts belonging to the organization. If this lookup is not established, manual filtering of AWS accounts will be required.
Service Accounts may need to be filtered.
Service Accounts may need to be filtered.
Detect when System Manager successfully executes commands against an instance.
Detects S3 object encryption using either customer-provided keys (SSE-C) or externally managed KMS keys (BYOK/XKS). These methods are leveraged by S3 ransomware variants to encrypt data with keys that are not controlled by the victim or AWS, making recovery difficult or impossible without paying a ransom.
This rule detects instances where PowerShell (powershell.exe or pwsh.exe) spawns 'node.exe' with command-line arguments containing '-e' and the process path is located within the 'AppData\Roaming' or 'AppData\Local' directories. This behavior can be indicative of malicious activity, such as the execution of Node.js-based scripts or malware by PowerShell, potentially for persistence or further execution within user-specific application data folders.
Detects various sensitive configuration modifications in AWS that could indicate malicious activity, such as privilege escalation, defense evasion, or data exposure. This rule looks for a curated list of API calls related to changes in IAM, EC2 security groups, S3 bucket policies, and logging configurations.
Detects the execution of TruffleHog, an open-source tool used for scanning repositories for secrets and sensitive information, within an AWS environment. This activity can indicate credential harvesting by threat actors. All detections should be investigated to determine if the usage is authorized by security teams or potentially malicious.
Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. This activity is uncommon and provides a high certainty signal.
Detects potentially suspicious events involving "GetSigninToken" in AWS. An adversary using the "aws_consoler" tool can leverage this console API to create temporary federated credentials, which can help obfuscate the compromised AWS credential (the original access key) and enable pivoting from the AWS CLI to console sessions without requiring MFA, using the newly issued access key.
Detects when an instance identity has taken an action that isn't inside SSM.
This can indicate that a compromised EC2 instance is being used as a pivot point.
This can indicate that a compromised EC2 instance is being used as a pivot point.
Detects the use of TruffleHog for AWS credential validation by identifying GetCallerIdentity API calls where the userAgent indicates TruffleHog. Threat actors leverage TruffleHog to enumerate and validate exposed AWS keys. Successful exploitation allows threat actors to confirm the validity of compromised AWS credentials, facilitating further unauthorized access and actions within the AWS environment.
This rule detects activities performed by the AWS root account. The root account has unrestricted access to all resources in an AWS account, making its usage a critical security event that often indicates a potential compromise, misconfiguration, or a highly privileged operation that should be closely monitored. The rule specifically looks for events where the 'userIdentity.type' is 'Root' and excludes 'AwsServiceEvent' to filter out automated AWS service activities that might legitimately use root permissions internally.
Detects successful AWS console logins that were performed without Multi-Factor Authentication (MFA). This alert can be used to identify potential unauthorized access attempts, as logging in without MFA can indicate compromised credentials or misconfigured security settings.
Page 30 of 46