Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
960 detections
Filters
Last updated
All Time
Detection languages
215
211
197
168
63
Contributors
283
142
113
112
85
Categories
670
218
168
112
95
Platforms
39,894
7,228
6,523
3,864
3,624
960
Products / Services
713
68
64
59
59
MITRE Techniques
310
305
146
136
134
CVEs
5
3
3
2
1
IDS Classtypes
13
11
11
9
8
IDS Protocols
62
1
Detect when an AWS S3 bucket is made public using ACL.
Detect when the S3 Public Access Block configuration has been removed from a bucket or an account.
Detect when an AWS security group is opened to the world (0.0.0.0/0) or (::/0)
Detects successful API executions from a Tor exit node.
Detects when an AWS user successfully authenticating from more than one unique IP address within 5 minutes.
Detects successful login after multiple failed attempts
Detects when an AWS IAM user creates an AWS Access Key for programmatic calls.
Amazon GuardDuty detects an Amazon EC2 instance or a container attempting to communicate with a black hole IP address.
Amazon GuardDuty detects a brute force activity in an Amazon EC2 or Amazon RDS instance.
Amazon GuardDuty detects Command and control activity in Amazon EC2, AWS Lambda or Amazon EKS Runtimes.
Amazon GuardDuty detects CryptoCurrency activity in Amazon EC2, AWS Lambda or Amazon EKS Runtimes.
Amazon GuardDuty detects a Denial of Service (DoS) activity in an Amazon EC2 instance.
Amazon GuardDuty detects Tor Network activity in an AWS account.
Detects when a user creates a Lambda function URL configuration, which could be used to expose the function to the internet and potentially allow unauthorized access to the function's IAM role for AWS API calls.
This could give an adversary access to the privileges associated with the Lambda service role that is attached to that function.
This could give an adversary access to the privileges associated with the Lambda service role that is attached to that function.
Detects modifications to an AWS RDS cluster or its deletion, which may indicate potential data exfiltration attempts, unauthorized access, or exposure of sensitive information. These actions can be performed by an attacker to disrupt services, remove evidence, or facilitate data theft.
Detects modifications to an RDS cluster or its deletion, which may indicate potential data exfiltration attempts, unauthorized access, or exposure of sensitive information.
Detects when AWS S3 bucket versioning is disabled. This action can be a precursor to data deletion or modification without the ability to recover previous versions, often seen in ransomware attacks targeting cloud storage.
Detects when S3 bucket versioning is disabled. Threat actors use this technique during AWS ransomware incidents prior to deleting S3 objects.
Detects changes to the security group entries for AWS RDS databases. This can indicate a misconfiguration that potentially exposes the database to the public internet, a wider audience within the VPC, or the removal of valid rules which could impact database availability for legitimate services and users. The rule specifically looks for API calls related to authorizing, creating, deleting, or revoking database security group ingress rules.
Detects when Microsoft Cloud App Security reports activities performed by users whose accounts have been terminated in Azure AD, but are still active in other platforms like AWS or Salesforce. This is particularly relevant for accounts used to manage resources that might not be terminated when a user leaves the company.
This rule detects when an AWS EC2 snapshot's permissions are modified to allow access from another AWS account. This activity can indicate an attempt to exfiltrate data stored in the snapshot by sharing it with an adversary-controlled account.
Page 44 of 46