Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
734 detections
Filters
Last updated
All Time
Detection languages
195
188
140
128
53
Contributors
229
147
111
94
34
Categories
613
214
127
93
73
Platforms
713
77
57
26
26
Products / Services
10,650
9,755
6,688
4,418
3,745
734
MITRE Techniques
294
276
143
124
106
CVEs
3
1
1
1
IDS Classtypes
5
5
4
2
IDS Protocols
16
Detects when a GuardDuty Detector's trusted or threat intel IP lists are deleted or disabled.
Detects when an Amazon RDS Snapshot is shared publicly.
Detects when CloudTrail logging is updated, stopped or deleted.
Detect when a user logs into AWS console without MFA.
Detects a successful attempt to retrieve the encrypted Administrator password for a Windows EC2 instance.
Detects when a high number of failed authentication attempts happen for unknown users.
Detects excessive AccessDenied events within an hour timeframe from an IAM User
Detect when the AWS managed policy AWSCompromisedKeyQuarantine has been attached to a user, role, or group. It is applied by the AWS team in the event that the credentials of an IAM user has been compromised or publicly exposed.
Detects create, update or delete events of a SAML provider in AWS.
Detect when the Amazon Simple Email Service (SES) has been modified where an attacker can modify Amazon SES service to propagate phishing emails campaigns.
Detects unusual number of failed authentications from the same IP for valid users.
Detect an AWS account attempting to leave or being removed from an AWS organization.
Detects when an insecure SSL policy is configured for an AWS Application Load Balancer.
AWS Backup Plan Deleted
YARA-L
Detects when AWS Backup Plan is deleted.
Detects when an insecure SSL policy is configured for an AWS CloudFront distribution.
Detects when AWS Config Service is updated, stopped or deleted.
AWS Delete VPC Flow Logs
YARA-L
Detects when AWS VPC FLow Logs are deleted.
Detects when an Amazon EC2 AMI or Snapshot is shared publicly.
Detect when an EC2 instance makes high number of API calls.
Detect modifications to user data script on an EC2 instance.
Detects excessive successful events within a 5 minute timeframe from an IAM User.
Page 32 of 35