Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
960 detections
Filters
Last updated
All Time
Detection languages
215
211
197
168
63
Contributors
283
142
113
112
85
Categories
670
218
168
112
95
Platforms
39,894
7,228
6,523
3,864
3,624
960
Products / Services
713
68
64
59
59
MITRE Techniques
310
305
146
136
134
CVEs
5
3
3
2
1
IDS Classtypes
13
11
11
9
8
IDS Protocols
62
1
Detects when an AWS region is enabled or disabled.
Amazon GuardDuty detects penetration testing activity from known offensive security distros such as KaliLinux, ParrotLinux or PentooLinux.
Detects API Calls from AWS accounts that are not part of the organization.
Detects when AWS API Gateway keys are accessed.
Detects when a CloudWatch log group is deleted.
Detects when a GuardDuty Detector's publishing destination has been deleted which will prevent the exporting of findings.
Detects when a GuardDuty Detector's trusted or threat intel IP lists are deleted or disabled.
Detects when an Amazon RDS Snapshot is shared publicly.
Detects when CloudTrail logging is updated, stopped or deleted.
Detect when a user logs into AWS console without MFA.
Detects a successful attempt to retrieve the encrypted Administrator password for a Windows EC2 instance.
Detects when a high number of failed authentication attempts happen for unknown users.
Detects excessive AccessDenied events within an hour timeframe from an IAM User
Detect when the AWS managed policy AWSCompromisedKeyQuarantine has been attached to a user, role, or group. It is applied by the AWS team in the event that the credentials of an IAM user has been compromised or publicly exposed.
Detects create, update or delete events of a SAML provider in AWS.
Detect when the Amazon Simple Email Service (SES) has been modified where an attacker can modify Amazon SES service to propagate phishing emails campaigns.
Detects unusual number of failed authentications from the same IP for valid users.
Amazon GuardDuty detects an Amazon EC2 instance or a container querying algorithmically generated domains (DGA).
Amazon GuardDuty detects a malicious or suspicious file on an Amazon EC2 instance or a container workload.
Detect an AWS account attempting to leave or being removed from an AWS organization.
Detects when an insecure SSL policy is configured for an AWS Application Load Balancer.
Page 42 of 46