Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
734 detections
Filters
Last updated
All Time
Detection languages
195
188
140
128
53
Contributors
229
147
111
94
34
Categories
613
214
127
93
73
Platforms
713
77
57
26
26
Products / Services
10,650
9,755
6,688
4,418
3,745
734
MITRE Techniques
294
276
143
124
106
CVEs
3
1
1
1
IDS Classtypes
5
5
4
2
IDS Protocols
16
Detects when an Amazon Simple Email Service (SES) identity is deleted. This action could be performed by an adversary to remove traces of their activities after using the SES identity for malicious purposes, such as sending spam or phishing emails, aligning with defense evasion tactics.
Detects when an AWS EFS (Elastic File System) mount target is deleted. This action can disrupt applications or instances relying on the mounted file system, potentially leading to a denial of service or data unavailability.
Detects when an AWS ElastiCache security group has been created. This action can be used by adversaries to establish persistence or modify network access to ElastiCache resources.
Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region.
Disabling default encryption does not change the encryption status of your existing volumes.
Disabling default encryption does not change the encryption status of your existing volumes.
An attempt to export an AWS EC2 instance has been detected. A VM Export might indicate an attempt to extract information from an instance.
Detects the modification of an EC2 snapshot's permissions to enable access from another account
Identifies when an EKS cluster is created or deleted.
Detects when a user tampers with S3 data management in Amazon Web Services.
Detects when an account makes changes to the ingress or egress rules of a security group.
This can indicate that an attacker is attempting to open up new attack vectors in the account, that they are trying to exfiltrate data over the network, or that they are trying to allow machines in that VPC/Subnet to contact a C&C server.
This can indicate that an attacker is attempting to open up new attack vectors in the account, that they are trying to exfiltrate data over the network, or that they are trying to allow machines in that VPC/Subnet to contact a C&C server.
Detects changes to the security groups associated with an Elastic Load Balancer (ELB) or Application Load Balancer (ALB).
This can indicate that a misconfiguration allowing more traffic into the system than required, or could indicate that an attacker is attempting to enable new connections into a VPC or subnet controlled by the account.
This can indicate that a misconfiguration allowing more traffic into the system than required, or could indicate that an attacker is attempting to enable new connections into a VPC or subnet controlled by the account.
Detects changes to the security group entries for RDS databases.
This can indicate that a misconfiguration has occurred which potentially exposes the database to the public internet, a wider audience within the VPC or that removal of valid rules has occurred which could impact the availability of the database to legitimate services and users.
This can indicate that a misconfiguration has occurred which potentially exposes the database to the public internet, a wider audience within the VPC or that removal of valid rules has occurred which could impact the availability of the database to legitimate services and users.
Detects changes to the EC2 instance startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up.
Detects when an Elastic Container Service (ECS) Task Definition includes a command to query the credential endpoint.
This can indicate a potential adversary adding a backdoor to establish persistence or escalate privileges.
This can indicate a potential adversary adding a backdoor to establish persistence or escalate privileges.
Detects when a EFS Fileshare is modified or deleted.
You can't delete a file system that is in use.
If the file system has any mount targets, the adversary must first delete them, so deletion of a mount will occur before deletion of a fileshare.
You can't delete a file system that is in use.
If the file system has any mount targets, the adversary must first delete them, so deletion of a mount will occur before deletion of a fileshare.
Detects when a EFS Fileshare Mount is modified or deleted. An adversary breaking any file system using the mount target that is being deleted, which might disrupt instances or applications using those mounts.
Detects when an ElastiCache security group has been created.
Identifies when an ElastiCache security group has been modified or deleted.
Detects possible suspicious glue development endpoint activity.
Detects the change of database master password. It may be a part of data exfiltration.
Detects the recovery of a new public database instance from a snapshot. It may be a part of data exfiltration.
Page 35 of 35