Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
960 detections
Filters
Last updated
All Time
Detection languages
215
211
197
168
63
Contributors
283
142
113
112
85
Categories
670
218
168
112
95
Platforms
39,894
7,228
6,523
3,864
3,624
960
Products / Services
713
68
64
59
59
MITRE Techniques
310
305
146
136
134
CVEs
5
3
3
2
1
IDS Classtypes
13
11
11
9
8
IDS Protocols
62
1
Detects usage of AWS CloudShell followed by S3 data-plane activity (GetObject/PutObject) from users without a documented baseline or exhibiting geographic anomalies. This pattern is indicative of potential misuse of a pre-authenticated execution context to perform unauthorized data staging or access, often evading host-based EDR monitoring.
Detects the provisioning of high-performance compute instances (GPU or high-CPU) in AWS regions that fall outside of an established organizational baseline. This behavior is often associated with unauthorized resource hijacking (cryptomining) by adversaries leveraging compromised IAM principals to deploy infrastructure in regions with lower visibility or monitoring coverage.
This rule detects modifications to AWS IAM policies via PutUserPolicy, PutRolePolicy, AttachUserPolicy, or AttachRolePolicy where the policy grants excessive permissions (wildcard Actions and Resources) or attaches an AdministratorAccess policy. The rule also flags rapid escalations occurring within 15 minutes of new user, role, or access key creation to identify potential self-escalation or unauthorized privilege escalation attempts by existing identities.
Detects modifications to AWS S3 bucket policies, access control lists (ACLs), or public access block configurations that result in public bucket exposure. The rule specifically flags broad permissions such as 'AllUsers' or wildcard principal entities, and correlates these findings with AWS Config or Access Analyzer data to confirm public reachability.
Detects unauthorized sharing of AWS EBS snapshots or RDS snapshots to external, unapproved AWS accounts. This activity is often a precursor to data exfiltration, where an adversary creates a snapshot of a production resource and shares it with an account under their control to bypass existing identity-based access controls.
Detects the creation of new AWS IAM access keys, with specific filtering for cross-principal creation, creation for sensitive accounts (e.g., service, admin), or excessive key creation activity. This pattern is often used by adversaries for persistence or privilege escalation in cloud environments.
This rule detects suspicious activities targeting cloud management hierarchy, specifically identifying attempts to remove AWS accounts from organizations, disable policy enforcement, create rogue accounts, or hijack Azure subscriptions through unauthorized transfers or tenant changes. Such actions are often used by adversaries to bypass security guardrails, remove organizational visibility, or establish persistent unauthorized access within a cloud environment.
This rule detects modifications to AWS CloudTrail configurations that reduce logging visibility, such as stopping the logging service, deleting a trail, or updating a trail to include restrictive event selectors (e.g., non-multi-region, read-only events, or excluding management events). These actions are indicative of an attacker attempting to evade detection by limiting the audit trail available to security analysts.
Detects changes to AWS S3 bucket policies or Access Control Lists (ACLs) that result in the bucket becoming publicly accessible. This is a common indicator of misconfiguration or unauthorized modification potentially leading to unauthorized data exposure.
This rule detects modifications to AWS EC2 Snapshot or AMI (Image) attributes that result in the resource becoming publicly accessible ('all') or shared with an unapproved AWS account ID. Such activities are often precursors to data exfiltration or unauthorized access to sensitive disk images.
This rule detects scenarios where an existing SSO or Identity Provider (IdP) session is reused from a device context that differs from the one that originally performed MFA. It identifies this by joining authentication events by SessionId, specifically looking for instances where MFA occurred in one event and a subsequent non-MFA event for the same session has a different User-Agent, DeviceId, JA3 hash, or Operating System build, indicating potential session token theft or reuse.
This rule correlates endpoint-based alerts related to credential theft or infostealer malware with subsequent successful cloud identity authentication events. It identifies situations where a user, who has recently triggered a credential theft alert on an endpoint, logs into a cloud environment from a country or IP address that has not been historically associated with that user within a 24-hour window.
Detects modifications to IAM role trust policies (UpdateAssumeRolePolicy) or the creation of new roles (CreateRole) where the Principal is configured with a wildcard or generic open access. This configuration enables any AWS account to assume the role, representing a significant risk for privilege escalation and persistence establishment by attackers.
Detects the mass creation of high-performance compute instances (GPU or high-memory variants) in an AWS environment. By filtering out legitimate service-linked roles associated with auto-scaling, the rule isolates potentially unauthorized manual provisioning, often indicative of cryptojacking or resource hijacking.
Detects 'CreateAccessKey' API calls in AWS CloudTrail where the principal making the request is different from the target IAM user. This pattern is commonly associated with persistence mechanisms where an attacker creates additional access keys on legitimate administrator accounts to maintain stealthy access.
Detects potential persistence mechanisms in AWS by monitoring the creation of new IAM users or roles, the issuance of long-lived credentials (access keys or login profiles), or the creation of roles with permissive cross-account trust policies. This rule specifically excludes known legitimate automation roles to reduce noise.
Detects the modification of EBS snapshot or AMI attributes to add createVolumePermission or launchPermission, which enables sharing the resource with an external AWS account. This action is a common precursor to cross-account data exfiltration or extortion via snapshot/AMI hijacking.
Detects the assignment of high-privilege roles to cloud user accounts in Entra ID, AWS, or GCP when that assignment is preceded by anomalous sign-in behavior (high-risk or failed authentication) within 24 hours, or when the account appears to be dormant (no activity in 90+ days) prior to the privilege assignment.
Detects unauthorized processes attempting to access the cloud instance metadata service (169.254.169.254). Adversaries frequently target this endpoint to extract sensitive instance information, such as IAM credentials or configuration data, typically as part of post-exploitation discovery or SSRF-based attacks.
Detects instances where an IAM user creates a new access key or requests a session token, followed by subsequent API activity from a different source IP address or region within a one-hour window. This behavior is often associated with the creation of persistence mechanisms or credential theft.
Detects modifications to AWS IAM policies (user or role policies) that grant AdministratorAccess, PowerUserAccess, or wildcard permissions (*). This is a common indicator of privilege escalation or persistence, where an attacker grants themselves or another identity broad administrative access within the AWS account.
Page 5 of 46