Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
960 detections
Filters
Last updated
All Time
Detection languages
215
211
197
168
63
Contributors
283
142
113
112
85
Categories
670
218
168
112
95
Platforms
39,897
7,231
6,523
3,864
3,624
960
Products / Services
713
68
64
59
59
MITRE Techniques
310
305
146
136
134
CVEs
5
3
3
2
1
IDS Classtypes
13
11
11
9
8
IDS Protocols
62
1
The following analytic identifies low, informational, or unknown severity findings from AWS Elastic Container Registry (ECR) image scans. It leverages AWS CloudTrail logs, specifically the DescribeImageScanFindings event, to detect these findings. This activity is significant for a SOC as it helps in early identification of potential vulnerabilities or misconfigurations in container images, which could be exploited if left unaddressed. If confirmed malicious, these findings could lead to unauthorized access, data breaches, or further exploitation within the containerized environment.
This analytic identifies failed attempts to delete AWS IAM groups. It leverages AWS CloudTrail logs to detect events where the DeleteGroup action fails due to errors like NoSuchEntityException, DeleteConflictException, or AccessDenied. This activity is significant as it may indicate unauthorized attempts to modify IAM group configurations, which could be a precursor to privilege escalation or other malicious actions. If confirmed malicious, this could allow an attacker to disrupt IAM policies, potentially leading to unauthorized access or denial of service within the AWS environment.
The following analytic identifies the successful deletion of an IAM group in AWS. It leverages CloudTrail logs to detect `DeleteGroup` events with a success status. This activity is significant as it could indicate potential changes in user permissions or access controls, which may be a precursor to further unauthorized actions. If confirmed malicious, an attacker could disrupt access management, potentially leading to privilege escalation or unauthorized access to sensitive resources. Analysts should review related IAM events, such as recent user additions or new group creations, to assess the broader context.
The analytic detects `StopLogging` events in AWS CloudTrail logs. It identifies when logging is intentionally stopped, excluding console-based actions and focusing on successful attempts. This activity is significant because adversaries may stop logging to evade detection and operate stealthily within the compromised environment. If confirmed malicious, this action could allow attackers to perform further activities without being logged, hindering incident response and forensic investigations, and potentially leading to unauthorized access or data exfiltration.
The analytic identifies medium-severity findings from AWS Elastic Container Registry (ECR) image scans. It leverages AWS CloudTrail logs, specifically the DescribeImageScanFindings event, to detect vulnerabilities in container images. This activity is significant for a SOC as it highlights potential security risks in containerized applications, which could be exploited if not addressed. If confirmed malicious, these vulnerabilities could lead to unauthorized access, data breaches, or further exploitation within the container environment, compromising the overall security posture.
The following analytic detects the deletion of AWS Network Access Control Lists (ACLs). It leverages AWS CloudTrail logs to identify events where a user deletes a network ACL entry. This activity is significant because deleting a network ACL can remove critical access restrictions, potentially allowing unauthorized access to cloud instances. If confirmed malicious, this action could enable attackers to bypass network security controls, leading to unauthorized access, data exfiltration, or further compromise of the cloud environment.
Detects when a user attaches a Lambda layer to an existing AWS Lambda function. A malicious Lambda layer could execute arbitrary code in the context of the function's IAM role, potentially granting an adversary access to resources the function has access to. This activity could indicate privilege escalation or unauthorized modification of serverless functions.
Detects when a user attached a Lambda layer to an existing Lambda function.
A malicious Lambda layer could execute arbitrary code in the context of the function's IAM role.
This would give an adversary access to resources that the function has access to.
A malicious Lambda layer could execute arbitrary code in the context of the function's IAM role.
This would give an adversary access to resources that the function has access to.
Detects API calls originating from AWS accounts that are not part of the organization, based on a reference list of approved AWS account IDs. This could indicate unauthorized access or activity from external entities.
This rule detects when an AWS Config Service is modified, stopped, or deleted. Specifically, it looks for CloudTrail events indicating actions such as stopping or deleting a configuration recorder, deleting a delivery channel, or putting (creating/updating) a delivery channel or configuration recorder. These actions can be indicative of an adversary attempting to impair defenses by disabling or modifying cloud logging capabilities.
This rule detects when an AWS account attempts to leave an AWS organization or is removed from an AWS organization. This activity can indicate an adversary attempting to evade detection or disrupt cloud infrastructure by isolating an account from central management and security policies.
This rule detects successful logins to the AWS console where Multi-Factor Authentication (MFA) was not used. It specifically looks for 'ConsoleLogin' events from AWS CloudTrail with an 'ALLOW' action and where 'MFAUsed' is explicitly set to 'No'. The rule also increases the risk score if the login is performed by a 'Root' user.
Detects when a high number of failed authentication attempts occur for unknown users on AWS, indicating a potential brute-force or credential stuffing attack against the AWS console.
Detects when the AWS managed policy 'AWSCompromisedKeyQuarantine' is attached to an IAM user, role, or group. This policy is typically applied by AWS when credentials for an IAM entity are suspected of being compromised or publicly exposed, indicating a potential security incident.
This rule detects successful AWS API calls originating from an IP address identified as a Tor exit node. It leverages a GCTI Feed for Tor exit node IP listings and also calculates a risk score based on the geographical location of the originating IP, specifically increasing the score for connections from Cuba, Iran, North Korea, Russia, and Syria.
Detects when an IAM user attempts to update or modify the code of an AWS Lambda function. This activity can be indicative of an attacker trying to introduce malicious code, backdoor existing functions, or alter their behavior for persistence, privilege escalation, or other malicious purposes.
This rule detects a successful login to the AWS console after multiple failed login attempts for the same user within a 15-minute window. It specifically looks for at least three failed authentication attempts followed by one successful authentication. The rule also calculates a risk score based on potential country mismatches between failed and successful attempts, and successful logins from unauthorized geographies (Cuba, Iran, North Korea, Russia, Syria).
Detects when an AWS IAM user creates an AWS Access Key for programmatic calls. This action can be used by adversaries to establish persistence or escalate privileges within an AWS environment.
This rule detects an unusual number of failed authentication attempts from the same IP address targeting valid users within an AWS environment. It specifically looks for 'ConsoleLogin' events from AWS CloudTrail where the security result indicates a 'BLOCK' action due to 'Failed authentication'. The rule triggers if there are more than 5 distinct target users experiencing failed logins from the same IP within a 5-minute window. Additionally, it calculates a risk score based on whether the source IP's country of origin is associated with known high-risk geographies (Cuba, Iran, North Korea, Russia, Syria).
This rule detects an excessive number of 'AccessDenied' events within a one-hour timeframe originating from a single AWS IAM user. This behavior can indicate an adversary attempting to discover cloud infrastructure and resources by making numerous API calls that they do not have permissions for. The rule specifically looks for more than 5 'AccessDenied' events, involving more than one target application and more than one product event type, from the same user within an hour.
This rule detects when an AWS S3 bucket's Access Control List (ACL) is modified to make the bucket publicly accessible. Specifically, it looks for `PutBucketAcl` events in AWS CloudTrail where the grantee URI is set to either "AuthenticatedUsers" (meaning any AWS user can access it) or "AllUsers" (meaning anyone on the internet can access it). This action indicates a potential misconfiguration or malicious activity leading to data exposure.
Page 39 of 46