Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
960 detections
Filters
Last updated
All Time
Detection languages
215
211
197
168
63
Contributors
283
142
113
112
85
Categories
670
218
168
112
95
Platforms
39,897
7,231
6,523
3,864
3,624
960
Products / Services
713
68
64
59
59
MITRE Techniques
310
305
146
136
134
CVEs
5
3
3
2
1
IDS Classtypes
13
11
11
9
8
IDS Protocols
62
1
Detects anomalous, large-scale provisioning of GPU-intensive cloud instances (such as p3, p4, g4dn, g5, and trn1 families) in AWS. This activity is indicative of cloud cryptojacking campaigns where adversaries hijack resources to rapidly spin up compute clusters for cryptomining, potentially incurring significant financial damage within a short period.
Detects attempts to tamper with or disable AWS security monitoring controls, specifically GuardDuty detectors and AWS Config recording. Attackers frequently disable these services to evade detection after gaining administrative permissions in a cloud environment.
This rule detects the creation of compute resources (EC2 instances, launch templates, or spot instances) within AWS regions that are designated as dormant or rarely used. This behavior is a common indicator of regional 'region-hopping,' used by attackers for cryptojacking or establishing C2 infrastructure to evade detection, particularly in regions where monitoring and cost-based alerts are less mature.
Detects potential privilege escalation sequences in AWS where an identity uses 'iam:PassRole' in conjunction with resource-creation APIs (such as 'lambda:CreateFunction', 'ec2:RunInstances', or 'cloudformation:CreateStack'). This pattern is indicative of an attacker attempting to attach a higher-privileged role to a newly created resource under their control, allowing them to perform actions beyond their current scope.
Detects modifications to AWS IAM trust relationships, specifically the creation or update of SAML providers, OIDC providers, or the update of role trust policies containing wildcard principals. These actions are indicative of an attacker attempting to establish a durable, credential-less persistence mechanism via federated identity manipulation.
Detects modifications to AWS Lambda functions that indicate potential backdooring, specifically unauthorized resource policy grants (lambda:InvokeFunction with a wildcard principal) or unexpected function code/configuration updates. This activity enables persistent, low-visibility execution by leveraging existing function permissions.
Detects modifications to AWS Lambda functions that indicate potential backdooring, specifically unauthorized resource policy grants (lambda:InvokeFunction with a wildcard principal) or unexpected function code/configuration updates. This activity enables persistent, low-visibility execution by leveraging existing function permissions.
Detects the creation or modification of credentials (access keys or login profiles) for the AWS root account or identities explicitly named to imply high-privilege administrative access. This is a high-fidelity indicator of persistence or unauthorized privilege escalation within an AWS environment.
Detects unauthorized cross-account copying of AWS EC2 or RDS snapshots, a key indicator of data exfiltration or staging as part of a snapshot-theft attack chain. The rule correlates copy events where the source snapshot owner is different from the destination account ID.
Detects the deletion of AWS CloudWatch log groups, log streams, metric filters, CloudWatch alarms, and VPC Flow Logs. Such actions are often indicative of an adversary attempting to destroy forensic evidence or disable security alerting prior to further unauthorized activity, such as data exfiltration or resource abuse.
Detects modifications to AWS CloudTrail event selectors that result in a loss of audit coverage (e.g., stopping management event logging or narrowing the ReadWriteType), which is a technique used by sophisticated actors to silently evade detection while keeping the trail status as enabled.
Detects the creation of an AWS IAM access key (CreateAccessKey) for the root account or identities with administrative naming conventions. This activity can indicate persistence establishment by an attacker who has gained high-privileged access, as new access keys provide a durable way to maintain programmatic control that bypasses standard session-based security controls.
Detects unauthorized attempts to stop CloudTrail logging or delete existing CloudTrail configurations within an AWS environment. Disabling logging is a significant indicator of defense evasion, often used by attackers to mask subsequent malicious activities such as data exfiltration, privilege escalation, or resource abuse.
Detects the creation of a new AWS IAM role with a trust policy that permits access from an external or wildcard principal, which is often used as a persistence mechanism to allow unauthorized cross-account access. The rule also triggers if an AdministratorAccess policy is attached to a newly created role, as these actions are commonly chained in cloud intrusions.
Detects AWS CloudTrail events where VPC Flow Logs are disabled or deleted, potentially indicating an adversary attempting to evade network monitoring by blinding detection mechanisms for lateral movement or data exfiltration.
Detects the attachment of the 'AdministratorAccess' managed policy or custom policies with wildcard actions and resources to AWS IAM users, roles, or groups. This activity is a critical indicator of privilege escalation, often serving as the final step in gaining full control of an AWS account by an adversary.
Detects unauthorized or suspicious modifications to AWS GuardDuty, including detector deletion, disabling of the service, disassociation from the master account, or the creation of suppression filters that archive findings, all of which indicate potential defense evasion by an adversary.
Detects the creation of a new AWS IAM policy version with 'SetAsDefault' enabled, specifically where the policy document contains overly permissive wildcard actions, resources, or full IAM administrative privileges. This technique allows an attacker to escalate privileges by modifying an existing policy version without updating the attachment status, effectively bypassing standard monitoring of policy attachments.
Detects the attachment of the 'AdministratorAccess' managed policy or custom policies with wildcard actions and resources to AWS IAM users, roles, or groups. This activity is a critical indicator of privilege escalation, often serving as the final step in gaining full control of an AWS account by an adversary.
This rule detects the use of browser-based cloud shells (AWS CloudShell, Azure Cloud Shell) as an entry point for post-exploitation activities, specifically tracking when these sessions are followed by object storage operations (S3 PutObject/GetObject or equivalent Azure Blob operations) within the same session context. This pattern is indicative of attackers using ephemeral cloud shells to stage stolen data or download offensive tooling, thereby bypassing host-based EDR monitoring.
Detects unauthorized attempts to delete CloudTrail log files or destroy the underlying storage bucket used for logs. This activity is a form of anti-forensics intended to remove evidence of malicious activity within the cloud control plane. The detection excludes legitimate automated S3 lifecycle management events.
Page 7 of 46