Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
734 detections
Filters
Last updated
All Time
Detection languages
195
188
140
128
53
Contributors
229
147
111
94
34
Categories
613
214
127
93
73
Platforms
713
77
57
26
26
Products / Services
10,650
9,755
6,688
4,418
3,745
734
MITRE Techniques
294
276
143
124
106
CVEs
3
1
1
1
IDS Classtypes
5
5
4
2
IDS Protocols
16
This rule detects AWS IAM activities associated with the S3 Browser utility. Specifically, it looks for attempts to create new users (`CreateUser`), create login profiles (`CreateLoginProfile`), create access keys (`CreateAccessKey`), or put user policies (`PutUserPolicy`) within AWS IAM. The detection is triggered when these actions are performed and the HTTP user agent string in the CloudTrail log indicates the use of 'S3 Browser'. This combination of actions and user agent suggests potential account manipulation for persistence or privilege escalation within an AWS environment.
This rule detects when AWS API Gateway keys are accessed with the 'includeValue' or 'includeValues' parameter set to 'true'. This indicates an attempt to retrieve the actual API key values, which could be a credential access attempt. The rule specifically looks for 'GetApiKey' and 'GetApiKeys' events in AWS CloudTrail logs where the request explicitly asks for the key's value.
Detects when an AWS CloudFront distribution is created or updated with an insecure SSL policy, specifically allowing TLSv1, SSLv3, TLSv1_2016, or TLSv1.1_2016. These protocols are considered insecure and can expose data to various attacks.
This rule detects when an EC2 instance makes a high number of API calls within a 5-minute window. The rule specifically looks for API calls originating from an assumed role associated with an EC2 instance, identified by a user ID matching the pattern `/i-.*$/`. A high number is defined as more than 7 distinct product event types within the specified timeframe. This behavior can indicate reconnaissance or other malicious activity from a compromised instance.
This rule detects when an Amazon RDS Snapshot is shared publicly. This action can lead to sensitive data exposure if the snapshot contains confidential information. The detection is based on AWS CloudTrail logs, specifically looking for 'ModifyDBSnapshotAttribute' or 'ModifyDBClusterSnapshotAttribute' events where the 'Request Parameters Values To Add' includes 'all' and 'Request Parameters Attribute Name' is 'restore'. This indicates an attempt to make the snapshot publicly restorable.
Detects when an AWS Key Management Service (KMS) key is disabled or scheduled for deletion. This activity can indicate an attempt to disrupt services, destroy data, or hinder forensic analysis by making encrypted data inaccessible.
This rule detects when an AWS user successfully authenticates to the AWS console from more than one unique IP address within a 5-minute window. This behavior can indicate a compromised account being accessed from multiple locations, potentially by different attackers, or by an attacker using a VPN/proxy service that rapidly changes IP addresses. The rule also includes an outcome that calculates a risk score based on successful logins originating from specific high-risk countries (Cuba, Iran, North Korea, Russia, Syria).
Detects when an AWS Application Load Balancer (ALB) listener is created or modified to use an insecure SSL policy. Insecure SSL policies can expose communication to vulnerabilities such as weak ciphers or outdated TLS versions, potentially allowing attackers to decrypt sensitive data or perform downgrade attacks. The rule specifically looks for the use of several known insecure or deprecated ELBSecurityPolicy versions during 'ModifyListener' or 'CreateListener' CloudTrail events.
This rule detects when an AWS region is enabled or disabled. Adversaries may enable new regions to create resources in an unmonitored environment or disable regions to disrupt services or evade detection. This activity is captured through AWS CloudTrail events for 'EnableRegion' or 'DisableRegion'.
Detects when a user creates or updates a login profile for another user in AWS IAM and then the newly created/modified user logs in from the same IP address. This behavior can indicate privilege escalation where an attacker gains access to an existing user's credentials, creates a new login profile or modifies an existing one for another user, and then uses that new profile to log in, potentially escalating their privileges or maintaining persistence.
Detects when an Amazon EC2 AMI (Amazon Machine Image) or Snapshot is modified to be shared publicly. This action can lead to sensitive data exposure or provide adversaries with a way to exfiltrate data by sharing it with an 'all' group, making it accessible to anyone.
Detects when an AWS GuardDuty Detector's trusted IP lists or threat intelligence IP lists are deleted or disabled. This activity could indicate an adversary attempting to impair defensive capabilities to avoid detection.
This rule detects administrative actions related to AWS SAML Identity Providers. Specifically, it triggers when a SAML provider is created, updated, or deleted within an AWS environment. Monitoring these events is crucial as SAML providers are used for federated access, and unauthorized changes could indicate attempts at persistence, privilege escalation, or defense evasion by manipulating authentication mechanisms.
This rule detects when the AWS IAM AdministratorAccess policy is attached to a user, group, or role. This action grants full administrative privileges and can be used by an attacker for privilege escalation, persistence, or to establish initial access within an AWS environment. The rule specifically looks for CloudTrail events indicating policy attachment actions (AttachUserPolicy, AttachGroupPolicy, AttachRolePolicy) where the target resource is the predefined 'AdministratorAccess' policy and the action was allowed.
Detects when an Amazon Simple Email Service (SES) configuration is modified, which could indicate an attacker attempting to propagate phishing email campaigns. This includes the creation, deletion, or verification of email identities and domains, as well as enabling sending for accounts or configuration sets.
This rule detects when an AWS security group ingress rule is modified to allow traffic from any IP address (0.0.0.0/0 for IPv4 or ::/0 for IPv6). This action, captured via AWS CloudTrail's AuthorizeSecurityGroupIngress event, significantly increases the attack surface of associated resources by making them accessible from the entire internet.
Detects when an AWS region is enabled or disabled.
Detects API Calls from AWS accounts that are not part of the organization.
Detects when AWS API Gateway keys are accessed.
Detects when a CloudWatch log group is deleted.
Detects when a GuardDuty Detector's publishing destination has been deleted which will prevent the exporting of findings.
Page 31 of 35