Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
734 detections
Filters
Last updated
All Time
Detection languages
195
188
140
128
53
Contributors
229
147
111
94
34
Categories
613
214
127
93
73
Platforms
713
77
57
26
26
Products / Services
10,665
9,758
6,692
4,418
3,749
734
MITRE Techniques
294
276
143
124
106
CVEs
3
1
1
1
IDS Classtypes
5
5
4
2
IDS Protocols
16
Detects unauthorized sharing, copying, or exporting of EBS, disk, or database snapshots to external cloud accounts, subscriptions, or projects that are not present in the defined trusted allow-list for AWS, Azure, or GCP environments.
Detects the creation of new programmatic credentials (AWS access keys, Azure AD service principal credentials, or GCP service account keys) where the identity creating the credential differs from the identity for which the credential is being issued. This behavior is often indicative of persistence mechanisms or credential abuse where an attacker with sufficient permissions creates secondary credentials for other accounts.
This rule detects the creation or modification of recurring cloud automation tasks (AWS EventBridge rules, Azure Automation Runbooks/Logic Apps, and GCP Cloud Scheduler jobs). Adversaries leverage these features to establish persistent access to a cloud environment by ensuring malicious code or scripts execute automatically, even after initial compromised credentials have been revoked.
Detects modifications to cloud-based IAM trust policies or resource policies that grant access to an external account, tenant, or project. This activity can indicate an attacker attempting to establish persistent backdoor access via cross-account trust relationships, bypassing standard identity controls.
Detects modifications to cloud security guardrails including AWS Service Control Policies (SCPs), Azure Policy assignments/exemptions, and GCP Organization Policies. These actions may indicate an attempt to disable security controls or weaken organizational policy enforcement.
Detects successful cloud console login events across AWS, Azure, and GCP where multi-factor authentication (MFA) was not utilized, combined with impossible travel indicators (login from different countries within an 8-hour window for the same principal).
Detects modifications to AWS S3 bucket policies, ACLs, or public access block settings that result in a bucket becoming publicly accessible. Attackers often leverage s3:PutBucketPolicy or similar permissions to make buckets public, allowing data exfiltration via anonymous HTTP requests and bypassing egress monitoring for direct API calls.
Detects the creation or modification of AWS IAM policies that grant administrative-level access (Action '*' on Resource '*') to a role, user, or group. This is a common technique used by attackers to gain or escalate privileges to full administrator access following initial foothold acquisition.
Detects the modification of AWS Security Groups where management ports (SSH, RDP, WinRM, or common database ports) are opened to the entire internet (0.0.0.0/0 or ::/0). This activity is indicative of creating a network-layer backdoor to maintain persistence or facilitate lateral movement within a cloud environment.
Detects the creation of an AWS IAM access key (CreateAccessKey) for the root account or identities with administrative naming conventions. This activity can indicate persistence establishment by an attacker who has gained high-privileged access, as new access keys provide a durable way to maintain programmatic control that bypasses standard session-based security controls.
Detects usage of AWS CloudShell followed by S3 data-plane activity (GetObject/PutObject) from users without a documented baseline or exhibiting geographic anomalies. This pattern is indicative of potential misuse of a pre-authenticated execution context to perform unauthorized data staging or access, often evading host-based EDR monitoring.
Detects the provisioning of high-performance compute instances (GPU or high-CPU) in AWS regions that fall outside of an established organizational baseline. This behavior is often associated with unauthorized resource hijacking (cryptomining) by adversaries leveraging compromised IAM principals to deploy infrastructure in regions with lower visibility or monitoring coverage.
This rule detects modifications to AWS IAM policies via PutUserPolicy, PutRolePolicy, AttachUserPolicy, or AttachRolePolicy where the policy grants excessive permissions (wildcard Actions and Resources) or attaches an AdministratorAccess policy. The rule also flags rapid escalations occurring within 15 minutes of new user, role, or access key creation to identify potential self-escalation or unauthorized privilege escalation attempts by existing identities.
Detects modifications to AWS S3 bucket policies, access control lists (ACLs), or public access block configurations that result in public bucket exposure. The rule specifically flags broad permissions such as 'AllUsers' or wildcard principal entities, and correlates these findings with AWS Config or Access Analyzer data to confirm public reachability.
Detects unauthorized sharing of AWS EBS snapshots or RDS snapshots to external, unapproved AWS accounts. This activity is often a precursor to data exfiltration, where an adversary creates a snapshot of a production resource and shares it with an account under their control to bypass existing identity-based access controls.
Detects the creation of new AWS IAM access keys, with specific filtering for cross-principal creation, creation for sensitive accounts (e.g., service, admin), or excessive key creation activity. This pattern is often used by adversaries for persistence or privilege escalation in cloud environments.
This rule detects suspicious activities targeting cloud management hierarchy, specifically identifying attempts to remove AWS accounts from organizations, disable policy enforcement, create rogue accounts, or hijack Azure subscriptions through unauthorized transfers or tenant changes. Such actions are often used by adversaries to bypass security guardrails, remove organizational visibility, or establish persistent unauthorized access within a cloud environment.
This rule detects modifications to AWS CloudTrail configurations that reduce logging visibility, such as stopping the logging service, deleting a trail, or updating a trail to include restrictive event selectors (e.g., non-multi-region, read-only events, or excluding management events). These actions are indicative of an attacker attempting to evade detection by limiting the audit trail available to security analysts.
Detects changes to AWS S3 bucket policies or Access Control Lists (ACLs) that result in the bucket becoming publicly accessible. This is a common indicator of misconfiguration or unauthorized modification potentially leading to unauthorized data exposure.
This rule detects modifications to AWS EC2 Snapshot or AMI (Image) attributes that result in the resource becoming publicly accessible ('all') or shared with an unapproved AWS account ID. Such activities are often precursors to data exfiltration or unauthorized access to sensitive disk images.
Detects modifications to IAM role trust policies (UpdateAssumeRolePolicy) or the creation of new roles (CreateRole) where the Principal is configured with a wildcard or generic open access. This configuration enables any AWS account to assume the role, representing a significant risk for privilege escalation and persistence establishment by attackers.
Page 4 of 35