Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
960 detections
Filters
Last updated
All Time
Detection languages
215
211
197
168
63
Contributors
283
142
113
112
85
Categories
670
218
168
112
95
Platforms
39,894
7,228
6,523
3,864
3,624
960
Products / Services
713
68
64
59
59
MITRE Techniques
310
305
146
136
134
CVEs
5
3
3
2
1
IDS Classtypes
13
11
11
9
8
IDS Protocols
62
1
Detects when an AWS account makes changes to the ingress or egress rules of a security group. This activity can indicate an attacker attempting to open new attack vectors, exfiltrate data over the network, or allow compromised machines to contact a command and control (C2) server.
This rule detects when the master password for an AWS RDS database instance is changed. This activity could be a precursor to data exfiltration or an attempt to gain unauthorized access to the database. The rule specifically looks for the 'ModifyDBInstance' event from 'rds.amazonaws.com' where the 'masterUserPassword' in 'pendingModifiedValues' is present, indicating a password change.
Detects changes to the security groups associated with an Elastic Load Balancer (ELB) or Application Load Balancer (ALB). This can indicate that a misconfiguration allowing more traffic into the system than required, or could indicate that an attacker is attempting to enable new connections into a VPC or subnet controlled by the account.
Identifies when the default Amazon Elastic Block Store (EBS) encryption is disabled in a specific AWS region. Disabling default encryption does not affect existing volumes but means newly created volumes will not be encrypted by default, potentially impacting data confidentiality and integrity.
This rule detects attempts to export an AWS EC2 instance, specifically when the 'CreateInstanceExportTask' event is logged in AWS CloudTrail. This action can be an indicator of an adversary attempting to exfiltrate data from a compromised EC2 instance by exporting it as a virtual machine image. The rule specifically looks for successful export task creations, filtering out events that contain error messages or codes, or indicate a 'Failure' in the response elements.
This rule detects when an AWS RDS database instance is restored from a snapshot and configured to be publicly accessible. This activity could indicate an attempt to exfiltrate data by making a copy of a database publicly available.
Detects changes to the EC2 instance startup script (User Data). The shell script will be executed as root/SYSTEM every time the specific instances are booted up, allowing for persistence and execution of arbitrary commands.
This rule detects attempts to modify or delete findings and insights within AWS SecurityHub. Adversaries may do this to evade detection by removing or altering security alerts generated by SecurityHub, thereby hindering defensive mechanisms and obscuring their activities. The rule specifically looks for 'BatchUpdateFindings', 'DeleteInsight', 'UpdateFindings', and 'UpdateInsight' events originating from 'securityhub.amazonaws.com'.
Detects when an AWS Elastic Container Service (ECS) Task Definition is created, described, or run, and its container definition includes a command that queries the AWS container credential endpoint. This activity can indicate an adversary attempting to establish persistence or escalate privileges by backdooring task definitions to extract credentials.
This rule detects when a user or entity makes changes to Amazon S3 bucket data management configurations. This includes modifications to logging, website hosting, encryption, lifecycle policies, replication configurations, and object restoration. Such changes could indicate an attempt to tamper with data integrity, availability, or exfiltration mechanisms within S3.
This rule identifies when an Amazon Elastic Kubernetes Service (EKS) cluster is either created or deleted. Monitoring these events can help detect unauthorized infrastructure changes, potential resource exhaustion, or malicious activity aimed at disrupting services or destroying data within a cloud environment.
Detects the creation, deletion, or update of AWS Glue Development Endpoints. This activity can be indicative of privilege escalation attempts or unauthorized resource manipulation within an AWS environment, as development endpoints provide an interactive environment for data processing.
Detects when an AWS EFS Fileshare is deleted. This action can indicate an attempt to disrupt availability or destroy data. Adversaries might delete file systems to impact operations or cover their tracks. Note that an EFS file system cannot be deleted if it has active mount targets, implying that mount targets would need to be deleted first.
Identifies when an ElastiCache security group has been modified or deleted.
Detects when an IP set is created in AWS GuardDuty. This activity could indicate an adversary attempting to whitelist their malicious IP addresses to avoid detection by GuardDuty, thereby disabling security alerts against their activities.
Detects when an Amazon Simple Email Service (SES) identity is deleted. This action could be performed by an adversary to remove traces of their activities after using the SES identity for malicious purposes, such as sending spam or phishing emails, aligning with defense evasion tactics.
Detects when an AWS EFS (Elastic File System) mount target is deleted. This action can disrupt applications or instances relying on the mounted file system, potentially leading to a denial of service or data unavailability.
Detects when an AWS ElastiCache security group has been created. This action can be used by adversaries to establish persistence or modify network access to ElastiCache resources.
Detects when a Microsoft Cloud App Security reported for users whose account were terminated in Azure AD, but still perform activities in other platforms such as AWS or Salesforce.
This is especially relevant for users who use another account to manage resources, since these accounts are often not terminated when a user leaves the company.
This is especially relevant for users who use another account to manage resources, since these accounts are often not terminated when a user leaves the company.
Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region.
Disabling default encryption does not change the encryption status of your existing volumes.
Disabling default encryption does not change the encryption status of your existing volumes.
An attempt to export an AWS EC2 instance has been detected. A VM Export might indicate an attempt to extract information from an instance.
Page 45 of 46