Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
734 detections
Filters
Last updated
All Time
Detection languages
195
188
140
128
53
Contributors
229
147
111
94
34
Categories
613
214
127
93
73
Platforms
713
77
57
26
26
Products / Services
10,650
9,755
6,688
4,418
3,745
734
MITRE Techniques
294
276
143
124
106
CVEs
3
1
1
1
IDS Classtypes
5
5
4
2
IDS Protocols
16
Detects when an AWS IAM user creates an AWS Access Key for programmatic calls. This action can be used by adversaries to establish persistence or escalate privileges within an AWS environment.
This rule detects an unusual number of failed authentication attempts from the same IP address targeting valid users within an AWS environment. It specifically looks for 'ConsoleLogin' events from AWS CloudTrail where the security result indicates a 'BLOCK' action due to 'Failed authentication'. The rule triggers if there are more than 5 distinct target users experiencing failed logins from the same IP within a 5-minute window. Additionally, it calculates a risk score based on whether the source IP's country of origin is associated with known high-risk geographies (Cuba, Iran, North Korea, Russia, Syria).
This rule detects an excessive number of 'AccessDenied' events within a one-hour timeframe originating from a single AWS IAM user. This behavior can indicate an adversary attempting to discover cloud infrastructure and resources by making numerous API calls that they do not have permissions for. The rule specifically looks for more than 5 'AccessDenied' events, involving more than one target application and more than one product event type, from the same user within an hour.
This rule detects when an AWS S3 bucket's Access Control List (ACL) is modified to make the bucket publicly accessible. Specifically, it looks for `PutBucketAcl` events in AWS CloudTrail where the grantee URI is set to either "AuthenticatedUsers" (meaning any AWS user can access it) or "AllUsers" (meaning anyone on the internet can access it). This action indicates a potential misconfiguration or malicious activity leading to data exposure.
This rule detects modifications to the user data script of an EC2 instance in AWS. User data scripts are executed when an EC2 instance is launched and can be used to perform initial setup, install software, or run other commands. An adversary modifying this script could achieve persistence or privilege escalation by injecting malicious commands that run upon the next instance boot.
This rule detects when AWS CloudTrail logging configurations are modified, stopped, or deleted. Specifically, it looks for API calls such as 'UpdateTrail', 'StopLogging', 'DeleteTrail', or 'PutEventSelectors' that indicate an attempt to tamper with CloudTrail's ability to record events. Such actions could be performed by an adversary to evade detection by hiding their activities.
This rule detects an excessive number of successful AWS API calls related to discovery activities (e.g., Describe*, List*, Get*) originating from a single IAM user within a 5-minute timeframe. This behavior can indicate an adversary attempting to map out the cloud environment after gaining initial access.
Detects when an AWS CloudWatch log group is deleted. This activity can be an indicator of an adversary attempting to impair defenses by removing or modifying logging capabilities to hide their actions.
This rule detects when an AWS IAM Access Analyzer is deleted. Deleting an Access Analyzer can be a defense evasion technique, as it removes a critical security monitoring tool that helps identify unintended external access to resources. An adversary might delete it to obscure their activities or prevent detection of misconfigurations they introduce.
Detects the registration of a new Multi-Factor Authentication (MFA) method for an AWS user. This can be an indicator of an attacker attempting to maintain persistence or bypass existing MFA controls by registering their own MFA device.
Detects when an AWS Backup Plan or Backup Selection is deleted. This activity can indicate an adversary attempting to inhibit system recovery by removing backup configurations, potentially as a precursor to data destruction or encryption for impact.
Detects a successful attempt to retrieve the encrypted Administrator password for a Windows EC2 instance using the GetPasswordData API call in AWS CloudTrail. This action indicates an adversary is attempting to gain access to credentials for a Windows virtual machine.
Detects AWS IAM activities originating from an EC2 instance that could be used to retain access or escalate privileges. This includes actions like creating users, attaching policies, creating/updating login profiles, creating access keys, creating groups, and creating roles.
Detects attempts to disable multi-factor authentication for an AWS IAM user by monitoring AWS CloudTrail events for 'DeleteVirtualMFADevice' or 'DeactivateMFADevice' actions. This could indicate an adversary attempting to maintain persistent access or bypass MFA for compromised accounts.
Detects when the S3 Public Access Block configuration has been removed from an AWS S3 bucket or an entire AWS account. This action can significantly increase the risk of public exposure for S3 objects, potentially leading to data breaches or unauthorized access. The rule specifically looks for `DeleteAccountPublicAccessBlock`, `DeleteBucketPublicAccessBlock` events, or `PutBucketPublicAccessBlock`/`PutAccountPublicAccessBlock` events where all public access blocking attributes (`RestrictPublicBuckets`, `BlockPublicPolicy`, `BlockPublicAcls`, `IgnorePublicAcls`) are set to false or are missing, indicating a removal or weakening of the public access block.
Detects when AWS VPC Flow Logs are deleted. This action can be an attempt by an adversary to impair defenses by removing or modifying logging capabilities to avoid detection of their activities.
This rule detects potential lateral movement within an AWS environment where an IAM session token, obtained via `GetSessionToken`, is subsequently used from a different IP address than where it was initially requested. This behavior can indicate an attacker has compromised credentials and is attempting to use them from a new location.
Detects when an AWS GuardDuty detector is disabled or suspended. This can indicate an adversary attempting to impair defenses to avoid detection.
Detects when an existing password policy is updated or deleted in an AWS account. This could indicate an adversary attempting to weaken password requirements to facilitate brute-force attacks or to remove obstacles for credential reuse.
This rule detects a specific privilege escalation scenario in AWS where a user creates a new access key for another user and then immediately uses that newly created access key from the same IP address to perform further actions. This behavior indicates an attempt to escalate privileges by leveraging a newly generated credential.
This rule detects when a GuardDuty Detector's publishing destination has been deleted. GuardDuty is an AWS threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect AWS accounts and workloads. Deleting its publishing destination prevents GuardDuty from exporting its findings, effectively impairing the organization's ability to detect and respond to security incidents. This action could be performed by an attacker attempting to hide their activities or by an insider aiming to reduce security visibility.
Page 30 of 35