Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
960 detections
Filters
Last updated
All Time
Detection languages
215
211
197
168
63
Contributors
283
142
113
112
85
Categories
670
218
168
112
95
Platforms
39,894
7,228
6,523
3,864
3,624
960
Products / Services
713
68
64
59
59
MITRE Techniques
310
305
146
136
134
CVEs
5
3
3
2
1
IDS Classtypes
13
11
11
9
8
IDS Protocols
62
1
AWS Backup Plan Deleted
YARA-L
Detects when AWS Backup Plan is deleted.
Detects when an insecure SSL policy is configured for an AWS CloudFront distribution.
Detects when AWS Config Service is updated, stopped or deleted.
AWS Delete VPC Flow Logs
YARA-L
Detects when AWS VPC FLow Logs are deleted.
Detects when an Amazon EC2 AMI or Snapshot is shared publicly.
Detect when an EC2 instance makes high number of API calls.
Detect modifications to user data script on an EC2 instance.
Detects excessive successful events within a 5 minute timeframe from an IAM User.
AWS GuardDuty Disabled
YARA-L
Detects when a GuardDuty Detector is disabled or suspended.
Detects when AWS IAM Access Analyzer is deleted.
Detect AWS IAM activities associated with the S3 Browser utility.
Detect AWS IAM activities made by AWS EC2 instances to retain access or escalate privileges.
Detects when AWS IAM AdministratorAccess policy is attached to a user, group or role which can be used for privilege escalation.
Detect when a KMS (Key Management Service) key is disabled or scheduled for deletion.
Detects an IAM user attempting to update/modify AWS lambda code.
Detect when an IAM session token is created and used from a different IP.
Detects attempts to disable multi-factor authentication for an AWS IAM user.
Detects the registration of a new Multi Factor authentication method for an AWS user.
Detects when an existing password policy is updated or deleted in an AWS account.
Detect when a user creates a new access key for another user and escalates privileges using this newly created access key from the same IP.
Detect when a user creates or updates a login profile for another user and escalates privileges using this new user from the same IP.
Page 43 of 46