Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
734 detections
Filters
Last updated
All Time
Detection languages
195
188
140
128
53
Contributors
229
147
111
94
34
Categories
613
214
127
93
73
Platforms
713
77
57
26
26
Products / Services
10,665
9,758
6,692
4,418
3,749
734
MITRE Techniques
294
276
143
124
106
CVEs
3
1
1
1
IDS Classtypes
5
5
4
2
IDS Protocols
16
Detects unauthorized or suspicious modifications to AWS GuardDuty, including detector deletion, disabling of the service, disassociation from the master account, or the creation of suppression filters that archive findings, all of which indicate potential defense evasion by an adversary.
Detects the creation of a new AWS IAM policy version with 'SetAsDefault' enabled, specifically where the policy document contains overly permissive wildcard actions, resources, or full IAM administrative privileges. This technique allows an attacker to escalate privileges by modifying an existing policy version without updating the attachment status, effectively bypassing standard monitoring of policy attachments.
Detects the attachment of the 'AdministratorAccess' managed policy or custom policies with wildcard actions and resources to AWS IAM users, roles, or groups. This activity is a critical indicator of privilege escalation, often serving as the final step in gaining full control of an AWS account by an adversary.
This rule detects the use of browser-based cloud shells (AWS CloudShell, Azure Cloud Shell) as an entry point for post-exploitation activities, specifically tracking when these sessions are followed by object storage operations (S3 PutObject/GetObject or equivalent Azure Blob operations) within the same session context. This pattern is indicative of attackers using ephemeral cloud shells to stage stolen data or download offensive tooling, thereby bypassing host-based EDR monitoring.
Detects unauthorized attempts to delete CloudTrail log files or destroy the underlying storage bucket used for logs. This activity is a form of anti-forensics intended to remove evidence of malicious activity within the cloud control plane. The detection excludes legitimate automated S3 lifecycle management events.
Detects the creation of a new AWS IAM policy version with 'SetAsDefault' enabled, specifically where the policy document contains overly permissive wildcard actions, resources, or full IAM administrative privileges. This technique allows an attacker to escalate privileges by modifying an existing policy version without updating the attachment status, effectively bypassing standard monitoring of policy attachments.
Detects the attachment of the 'AdministratorAccess' managed policy or custom policies with wildcard actions and resources to AWS IAM users, roles, or groups. This activity is a critical indicator of privilege escalation, often serving as the final step in gaining full control of an AWS account by an adversary.
Detects the creation of a new AWS IAM policy version with 'SetAsDefault' enabled, specifically where the policy document contains overly permissive wildcard actions, resources, or full IAM administrative privileges. This technique allows an attacker to escalate privileges by modifying an existing policy version without updating the attachment status, effectively bypassing standard monitoring of policy attachments.
Detects unauthorized attempts to delete CloudTrail log files or destroy the underlying storage bucket used for logs. This activity is a form of anti-forensics intended to remove evidence of malicious activity within the cloud control plane. The detection excludes legitimate automated S3 lifecycle management events.
This rule detects the use of browser-based cloud shells (AWS CloudShell, Azure Cloud Shell) as an entry point for post-exploitation activities, specifically tracking when these sessions are followed by object storage operations (S3 PutObject/GetObject or equivalent Azure Blob operations) within the same session context. This pattern is indicative of attackers using ephemeral cloud shells to stage stolen data or download offensive tooling, thereby bypassing host-based EDR monitoring.
Detects modifications to AWS IAM role trust policies (UpdateAssumeRolePolicy) that introduce wildcard principals, external AWS account ARNs, or federated identity providers (SAML/OIDC). This behavior is indicative of cross-tenant persistence or backdooring, enabling an adversary to assume privileged roles from an external account without creating local credentials.
Detects the launch of compute-optimized or GPU-accelerated EC2 instances via the RunInstances API. This behavior is a common indicator of unauthorized resource hijacking, such as cryptomining, where attackers leverage compromised credentials to deploy resource-intensive workloads in regions that have not been historically used by the organization.
This rule detects the launch of an AWS EC2 instance that is configured with an IAM instance profile containing administrative keywords (e.g., AdministratorAccess, FullAccess) or a wildcard (*). Attackers can abuse this configuration after gaining initial access to the console or API to attach an over-privileged profile to a new instance, then pivot to the instance metadata service (IMDS) to extract these administrative credentials for persistent, broadly-scoped access.
Detects the creation of AWS Lambda functions by non-standard principals that assign an execution role with potentially broader privileges than the creator, indicative of an IAM privilege escalation technique where an attacker abuses iam:PassRole and lambda:CreateFunction to execute code under an elevated identity.
Detects modifications to RDS or Aurora snapshot attributes that grant public access ('all') or share the snapshot with an external AWS account ID. This activity indicates a potential data exfiltration attempt, as sharing a snapshot allows an external party to restore the database in their own environment, bypassing existing application-layer access controls.
Detects modifications to AWS S3 bucket policies, ACLs, or public access block settings that result in the bucket becoming publicly accessible. This covers PutBucketPolicy actions with wide-open principals, PutBucketAcl actions granting access to global groups (AllUsers or AuthenticatedUsers), and disabling the 'Block Public Access' feature.
Detects the creation of an AWS IAM access key followed immediately by the use of that key from a new or anomalous geolocation, which is a strong indicator of credential theft or unauthorized key generation for persistence.
Detects the creation or modification of AWS Lambda functions that are associated with high-privilege IAM actions and triggered by EventBridge rules monitoring sensitive events like IAM user creation or console logins. This pattern indicates an attempt to establish event-driven, persistent backdoors within the AWS environment by automating malicious actions on new users or logins.
Detects modifications to EBS snapshot attributes via ModifySnapshotAttribute where the snapshot is made publicly accessible (all group) or shared with an unauthorized AWS account ID, potentially indicating unauthorized exfiltration of disk contents.
Detects the use of iam:CreatePolicyVersion and iam:SetDefaultPolicyVersion API calls, which are critical IAM actions that can be abused to escalate privileges by defining a new version of an IAM policy with excessive permissions and setting it as the default.
Detects rapid, large-scale deployment of high-vCPU/GPU compute instances, potentially indicating resource hijacking for cryptomining. The rule correlates high-compute instance launches with preceding AWS service quota increases, identifying potential malicious activity within an AWS environment.
Page 7 of 35