Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
734 detections
Filters
Last updated
All Time
Detection languages
195
188
140
128
53
Contributors
229
147
111
94
34
Categories
613
214
127
93
73
Platforms
713
77
57
26
26
Products / Services
10,665
9,758
6,692
4,418
3,749
734
MITRE Techniques
294
276
143
124
106
CVEs
3
1
1
1
IDS Classtypes
5
5
4
2
IDS Protocols
16
Detects a privilege escalation sequence where a principal uses 'PassRole' to attach an IAM role to a newly created compute resource (Lambda, EC2, or CloudFormation stack), followed shortly by that compute resource performing privileged API calls. This behavior indicates a potential attempt to gain unauthorized elevated permissions by executing actions from an over-privileged service identity.
Detects a privilege escalation sequence where a principal uses 'PassRole' to attach an IAM role to a newly created compute resource (Lambda, EC2, or CloudFormation stack), followed shortly by that compute resource performing privileged API calls. This behavior indicates a potential attempt to gain unauthorized elevated permissions by executing actions from an over-privileged service identity.
Detects the creation of new AWS IAM access keys where the actor initiating the request is distinct from the target user associated with the key. This behavior often indicates an adversary attempting to establish persistent access to a compromised account by creating additional, long-lived credentials.
Detects suspicious modifications to AWS Organization structure, specifically the moving of accounts out of protected organizational units (e.g., security, quarantine, guardrail), accounts leaving the organization, or the detachment of policies, which may indicate an attempt to evade security controls or organizational guardrails.
This rule detects modifications to AWS EC2 Snapshot or AMI (Image) attributes that result in the resource becoming publicly accessible ('all') or shared with an unapproved AWS account ID. Such activities are often precursors to data exfiltration or unauthorized access to sensitive disk images.
This rule detects modifications to AWS CloudTrail configurations that reduce logging visibility, such as stopping the logging service, deleting a trail, or updating a trail to include restrictive event selectors (e.g., non-multi-region, read-only events, or excluding management events). These actions are indicative of an attacker attempting to evade detection by limiting the audit trail available to security analysts.
Detects 'ec2:RunInstances' API calls occurring in AWS regions that are not part of the organization's approved allow-list. This behavior can be indicative of malicious infrastructure staging, such as deploying assets for unauthorized cryptomining or establishing pivot points in regions that are infrequently monitored.
Detects the initialization of an AWS CloudShell session followed by file transfer operations (PutFile or GetFile). This behavior may indicate an attacker using CloudShell to stage, exfiltrate, or move tools within the cloud environment, potentially bypassing endpoint detection by operating within the cloud service infrastructure.
This rule detects modifications to AWS IAM policies (PutUserPolicy, PutRolePolicy, PutGroupPolicy, AttachUserPolicy, AttachRolePolicy, or CreatePolicyVersion) that result in a policy granting administrative '*' access to both Actions and Resources. This pattern is commonly used by adversaries for persistence and privilege escalation after initial IAM credential compromise.
Detects a privilege escalation sequence where a principal uses 'PassRole' to attach an IAM role to a newly created compute resource (Lambda, EC2, or CloudFormation stack), followed shortly by that compute resource performing privileged API calls. This behavior indicates a potential attempt to gain unauthorized elevated permissions by executing actions from an over-privileged service identity.
Detects changes to AWS S3 bucket policies or Access Control Lists (ACLs) that result in the bucket becoming publicly accessible. This is a common indicator of misconfiguration or unauthorized modification potentially leading to unauthorized data exposure.
Detects the creation of new AWS IAM access keys where the actor initiating the request is distinct from the target user associated with the key. This behavior often indicates an adversary attempting to establish persistent access to a compromised account by creating additional, long-lived credentials.
Detects suspicious modifications to AWS Organization structure, specifically the moving of accounts out of protected organizational units (e.g., security, quarantine, guardrail), accounts leaving the organization, or the detachment of policies, which may indicate an attempt to evade security controls or organizational guardrails.
Detects instances where an IAM user or role attempts to assume a role in a different AWS account (Cross-Account) without providing a valid ExternalID. This often indicates unauthorized attempts to access or abuse cross-account trust relationships, which is a common technique for lateral movement or privilege escalation in cloud environments.
Detects instances where an IAM user or role attempts to assume a role in a different AWS account (Cross-Account) without providing a valid ExternalID. This often indicates unauthorized attempts to access or abuse cross-account trust relationships, which is a common technique for lateral movement or privilege escalation in cloud environments.
Detects modifications to AWS CloudTrail logging configurations, specifically changes to trails or subscription filters that could be used to suppress, redirect, or disrupt the collection of audit logs, potentially masking malicious activity.
Detects the creation of an AWS Lambda function that is assigned an excessively privileged execution role (e.g., AdministratorAccess). Attackers often leverage this technique to establish persistence or facilitate privilege escalation by creating backdoored functions that run with broad administrative permissions.
Detects the modification or attachment of IAM policies to users or roles that contain wildcard 'Allow' permissions for all actions and resources. This behavior is indicative of privilege escalation where an identity is granted full administrative control over the AWS account.
This rule detects the initialization of an AWS CloudShell environment or session where Multi-Factor Authentication (MFA) was not explicitly recorded in the event data. Unauthorized access to CloudShell can provide an adversary with a command-line interface to interact with AWS APIs, potentially facilitating further malicious activities.
Detects potential privilege escalation where an identity with iam:PassRole permissions deploys or updates compute resources (CloudFormation, EC2, or Lambda) to assume a more privileged IAM role than the user currently holds.
Detects the use of sts:AssumeRole or sts:GetFederationToken to request temporary security credentials in a different AWS account than the one initiating the request. This can indicate cross-account privilege escalation or lateral movement using identity federation or assumed roles.
Page 9 of 35