Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
734 detections
Filters
Last updated
All Time
Detection languages
195
188
140
128
53
Contributors
229
147
111
94
34
Categories
613
214
127
93
73
Platforms
713
77
57
26
26
Products / Services
10,650
9,755
6,688
4,418
3,745
734
MITRE Techniques
294
276
143
124
106
CVEs
3
1
1
1
IDS Classtypes
5
5
4
2
IDS Protocols
16
Detects modifications to an AWS RDS cluster or its deletion, which may indicate potential data exfiltration attempts, unauthorized access, or exposure of sensitive information. These actions can be performed by an attacker to disrupt services, remove evidence, or facilitate data theft.
Detects modifications to an RDS cluster or its deletion, which may indicate potential data exfiltration attempts, unauthorized access, or exposure of sensitive information.
Detects when AWS S3 bucket versioning is disabled. This action can be a precursor to data deletion or modification without the ability to recover previous versions, often seen in ransomware attacks targeting cloud storage.
Detects when S3 bucket versioning is disabled. Threat actors use this technique during AWS ransomware incidents prior to deleting S3 objects.
Detects changes to the security group entries for AWS RDS databases. This can indicate a misconfiguration that potentially exposes the database to the public internet, a wider audience within the VPC, or the removal of valid rules which could impact database availability for legitimate services and users. The rule specifically looks for API calls related to authorizing, creating, deleting, or revoking database security group ingress rules.
This rule detects when an AWS EC2 snapshot's permissions are modified to allow access from another AWS account. This activity can indicate an attempt to exfiltrate data stored in the snapshot by sharing it with an adversary-controlled account.
Detects when an AWS account makes changes to the ingress or egress rules of a security group. This activity can indicate an attacker attempting to open new attack vectors, exfiltrate data over the network, or allow compromised machines to contact a command and control (C2) server.
This rule detects when the master password for an AWS RDS database instance is changed. This activity could be a precursor to data exfiltration or an attempt to gain unauthorized access to the database. The rule specifically looks for the 'ModifyDBInstance' event from 'rds.amazonaws.com' where the 'masterUserPassword' in 'pendingModifiedValues' is present, indicating a password change.
Detects changes to the security groups associated with an Elastic Load Balancer (ELB) or Application Load Balancer (ALB). This can indicate that a misconfiguration allowing more traffic into the system than required, or could indicate that an attacker is attempting to enable new connections into a VPC or subnet controlled by the account.
Identifies when the default Amazon Elastic Block Store (EBS) encryption is disabled in a specific AWS region. Disabling default encryption does not affect existing volumes but means newly created volumes will not be encrypted by default, potentially impacting data confidentiality and integrity.
This rule detects attempts to export an AWS EC2 instance, specifically when the 'CreateInstanceExportTask' event is logged in AWS CloudTrail. This action can be an indicator of an adversary attempting to exfiltrate data from a compromised EC2 instance by exporting it as a virtual machine image. The rule specifically looks for successful export task creations, filtering out events that contain error messages or codes, or indicate a 'Failure' in the response elements.
This rule detects when an AWS RDS database instance is restored from a snapshot and configured to be publicly accessible. This activity could indicate an attempt to exfiltrate data by making a copy of a database publicly available.
Detects changes to the EC2 instance startup script (User Data). The shell script will be executed as root/SYSTEM every time the specific instances are booted up, allowing for persistence and execution of arbitrary commands.
This rule detects attempts to modify or delete findings and insights within AWS SecurityHub. Adversaries may do this to evade detection by removing or altering security alerts generated by SecurityHub, thereby hindering defensive mechanisms and obscuring their activities. The rule specifically looks for 'BatchUpdateFindings', 'DeleteInsight', 'UpdateFindings', and 'UpdateInsight' events originating from 'securityhub.amazonaws.com'.
Detects when an AWS Elastic Container Service (ECS) Task Definition is created, described, or run, and its container definition includes a command that queries the AWS container credential endpoint. This activity can indicate an adversary attempting to establish persistence or escalate privileges by backdooring task definitions to extract credentials.
This rule detects when a user or entity makes changes to Amazon S3 bucket data management configurations. This includes modifications to logging, website hosting, encryption, lifecycle policies, replication configurations, and object restoration. Such changes could indicate an attempt to tamper with data integrity, availability, or exfiltration mechanisms within S3.
This rule identifies when an Amazon Elastic Kubernetes Service (EKS) cluster is either created or deleted. Monitoring these events can help detect unauthorized infrastructure changes, potential resource exhaustion, or malicious activity aimed at disrupting services or destroying data within a cloud environment.
Detects the creation, deletion, or update of AWS Glue Development Endpoints. This activity can be indicative of privilege escalation attempts or unauthorized resource manipulation within an AWS environment, as development endpoints provide an interactive environment for data processing.
Detects when an AWS EFS Fileshare is deleted. This action can indicate an attempt to disrupt availability or destroy data. Adversaries might delete file systems to impact operations or cover their tracks. Note that an EFS file system cannot be deleted if it has active mount targets, implying that mount targets would need to be deleted first.
Identifies when an ElastiCache security group has been modified or deleted.
Detects when an IP set is created in AWS GuardDuty. This activity could indicate an adversary attempting to whitelist their malicious IP addresses to avoid detection by GuardDuty, thereby disabling security alerts against their activities.
Page 34 of 35