Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
960 detections
Filters
Last updated
All Time
Detection languages
215
211
197
168
63
Contributors
283
142
113
112
85
Categories
670
218
168
112
95
Platforms
39,908
7,245
6,529
3,864
3,627
960
Products / Services
713
68
64
59
59
MITRE Techniques
310
305
146
136
134
CVEs
5
3
3
2
1
IDS Classtypes
13
11
11
9
8
IDS Protocols
62
1
The following analytic identifies cloud instances being modified by users who have not previously modified them. It leverages data from the Change data model, focusing on successful modifications of EC2 instances. This activity is significant because it can indicate unauthorized or suspicious changes by potentially compromised or malicious users. If confirmed malicious, this could lead to unauthorized access, configuration changes, or potential disruption of cloud services, posing a significant risk to the organization's cloud infrastructure.
The following analytic detects cloud provisioning activities originating from previously unseen cities. It leverages cloud infrastructure logs and compares the geographic location of the source IP address against a baseline of known locations. This activity is significant as it may indicate unauthorized access or misuse of cloud resources from an unexpected location. If confirmed malicious, this could lead to unauthorized resource creation, potential data exfiltration, or further compromise of cloud infrastructure.
The following analytic detects cloud provisioning activities originating from previously unseen IP addresses. It leverages cloud infrastructure logs to identify events where resources are created or started, and cross-references these with a baseline of known IP addresses. This activity is significant as it may indicate unauthorized access or potential misuse of cloud resources. If confirmed malicious, an attacker could gain unauthorized control over cloud resources, leading to data breaches, service disruptions, or increased operational costs.
The following analytic detects cloud provisioning activities originating from previously unseen regions. It leverages cloud infrastructure logs to identify events where resources are started or created, and cross-references these with a baseline of known regions. This activity is significant as it may indicate unauthorized access or misuse of cloud resources from unfamiliar locations. If confirmed malicious, this could lead to unauthorized resource creation, potential data exfiltration, or further compromise of cloud infrastructure.
Detects the creation of scheduled tasks, recurring jobs, or webhook subscriptions by a user identity flagged as an AI_AGENT. This activity is monitored for persistence, especially when the event lacks a descriptive context or targets external networks, suggesting potential unauthorized agent behavioral drift or malicious persistence.
Detects anomalous, high-volume file deletion, modification, or resource deletion operations performed by an identified AI agent service account within a short timeframe. This behavior is indicative of a compromised AI agent being leveraged for mass data destruction, ransomware activity, or disruptive configuration changes.
Detects the use of open-source secret-scanning tools (e.g., TruffleHog) by identifying their specific User-Agent strings in AWS CloudTrail logs during GetCallerIdentity calls, followed by suspicious enumeration activity (ListBuckets, ListSecrets, ListAccessKeys) from the same source IP. This behavior is indicative of threat actors validating stolen credentials for unauthorized access to cloud resources.
Detects anomalous bursts of sts:GetCallerIdentity API calls, which are often used by adversaries to validate harvested or stolen AWS access keys. The rule monitors for a high frequency of such calls or a large number of distinct access keys being validated from IP addresses that are not part of the organization's approved corporate or cloud egress ranges.
Detects unauthorized modification or deletion of AWS Bedrock model invocation logging configurations. Adversaries may use this technique to disable visibility into LLM usage or redirect logs to an attacker-controlled storage location to hide subsequent malicious activity.
Detects anomalous, unauthorized access to machine learning model artifacts (e.g., .onnx, .pt, .h5) within object storage or model registries. The rule identifies suspicious patterns including high-volume file reads by non-ML team identities, lack of multi-factor authentication, or access from geolocations outside approved operating regions, indicative of potential model exfiltration or intellectual property theft.
This rule detects anomalous activity involving cloud-based shell services (AWS CloudShell, Azure Cloud Shell, GCP Cloud Shell). It triggers on two main conditions: (1) First-time usage of these shell environments by a principal within the detection window, and (2) The execution of commands associated with data staging, ingress tool transfer, or exfiltration (e.g., curl, wget, storage copy commands).
Detects unauthorized sharing, copying, or exporting of EBS, disk, or database snapshots to external cloud accounts, subscriptions, or projects that are not present in the defined trusted allow-list for AWS, Azure, or GCP environments.
Detects the creation of new programmatic credentials (AWS access keys, Azure AD service principal credentials, or GCP service account keys) where the identity creating the credential differs from the identity for which the credential is being issued. This behavior is often indicative of persistence mechanisms or credential abuse where an attacker with sufficient permissions creates secondary credentials for other accounts.
This rule detects the creation or modification of recurring cloud automation tasks (AWS EventBridge rules, Azure Automation Runbooks/Logic Apps, and GCP Cloud Scheduler jobs). Adversaries leverage these features to establish persistent access to a cloud environment by ensuring malicious code or scripts execute automatically, even after initial compromised credentials have been revoked.
Detects modifications to cloud-based IAM trust policies or resource policies that grant access to an external account, tenant, or project. This activity can indicate an attacker attempting to establish persistent backdoor access via cross-account trust relationships, bypassing standard identity controls.
Detects modifications to cloud security guardrails including AWS Service Control Policies (SCPs), Azure Policy assignments/exemptions, and GCP Organization Policies. These actions may indicate an attempt to disable security controls or weaken organizational policy enforcement.
Detects successful cloud console login events across AWS, Azure, and GCP where multi-factor authentication (MFA) was not utilized, combined with impossible travel indicators (login from different countries within an 8-hour window for the same principal).
Detects modifications to AWS S3 bucket policies, ACLs, or public access block settings that result in a bucket becoming publicly accessible. Attackers often leverage s3:PutBucketPolicy or similar permissions to make buckets public, allowing data exfiltration via anonymous HTTP requests and bypassing egress monitoring for direct API calls.
Detects the creation or modification of AWS IAM policies that grant administrative-level access (Action '*' on Resource '*') to a role, user, or group. This is a common technique used by attackers to gain or escalate privileges to full administrator access following initial foothold acquisition.
Detects the modification of AWS Security Groups where management ports (SSH, RDP, WinRM, or common database ports) are opened to the entire internet (0.0.0.0/0 or ::/0). This activity is indicative of creating a network-layer backdoor to maintain persistence or facilitate lateral movement within a cloud environment.
Detects the creation of an AWS IAM access key (CreateAccessKey) for the root account or identities with administrative naming conventions. This activity can indicate persistence establishment by an attacker who has gained high-privileged access, as new access keys provide a durable way to maintain programmatic control that bypasses standard session-based security controls.
Page 4 of 46