Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
734 detections
Filters
Last updated
All Time
Detection languages
195
188
140
128
53
Contributors
229
147
111
94
34
Categories
613
214
127
93
73
Platforms
713
77
57
26
26
Products / Services
10,650
9,755
6,688
4,418
3,745
734
MITRE Techniques
294
276
143
124
106
CVEs
3
1
1
1
IDS Classtypes
5
5
4
2
IDS Protocols
16
AWS GuardDuty Disabled
YARA-L
Detects when a GuardDuty Detector is disabled or suspended.
Detects when AWS IAM Access Analyzer is deleted.
Detect AWS IAM activities associated with the S3 Browser utility.
Detect AWS IAM activities made by AWS EC2 instances to retain access or escalate privileges.
Detects when AWS IAM AdministratorAccess policy is attached to a user, group or role which can be used for privilege escalation.
Detect when a KMS (Key Management Service) key is disabled or scheduled for deletion.
Detects an IAM user attempting to update/modify AWS lambda code.
Detect when an IAM session token is created and used from a different IP.
Detects attempts to disable multi-factor authentication for an AWS IAM user.
Detects the registration of a new Multi Factor authentication method for an AWS user.
Detects when an existing password policy is updated or deleted in an AWS account.
Detect when a user creates a new access key for another user and escalates privileges using this newly created access key from the same IP.
Detect when a user creates or updates a login profile for another user and escalates privileges using this new user from the same IP.
Detect when an AWS S3 bucket is made public using ACL.
Detect when the S3 Public Access Block configuration has been removed from a bucket or an account.
Detect when an AWS security group is opened to the world (0.0.0.0/0) or (::/0)
Detects successful API executions from a Tor exit node.
Detects when an AWS user successfully authenticating from more than one unique IP address within 5 minutes.
Detects successful login after multiple failed attempts
Detects when an AWS IAM user creates an AWS Access Key for programmatic calls.
Detects when a user creates a Lambda function URL configuration, which could be used to expose the function to the internet and potentially allow unauthorized access to the function's IAM role for AWS API calls.
This could give an adversary access to the privileges associated with the Lambda service role that is attached to that function.
This could give an adversary access to the privileges associated with the Lambda service role that is attached to that function.
Page 33 of 35