Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
462 detections
Filters
Last updated
All Time
Detection languages
135
111
68
41
32
Contributors
136
63
56
49
29
Categories
264
153
62
61
59
Platforms
39,951
7,276
6,526
3,865
3,641
462
Products / Services
260
63
57
52
51
MITRE Techniques
148
103
61
59
58
CVEs
3
2
2
1
1
IDS Classtypes
7
5
5
4
3
IDS Protocols
27
Detects process execution events where a web server or PHP worker process spawns a shell or script interpreter that references sensitive files (such as credentials, configuration files, or SSH keys) or queries the cloud instance metadata service.
Detects GCP audit log write operations involving settings, IAM, or metadata modifications (such as setMetadata, setIamPolicy, setServiceAccount) that either originate from a known attacker IP or are performed by a default GCP service account from a public caller IP.
Detects a suspicious sequence of activities in GCP Compute Engine where a principal creates a new VM instance, attaches a disk, and creates a disk snapshot or new disk within a short window, potentially indicating data staging or exfiltration preparation.
This rule queries the ExposureGraphNodes table to identify and summarize assets that are configured as internet-facing or exposed to the internet.
Detects successful Google Workspace logins from an IP address or user agent not previously seen for the user within a 24-hour window.
Detects the use of curl or wget commands targeting the Cloud Instance Metadata Service (IMDS) at 169.254.169.254 for credential theft, or performing file uploads and data exfiltration patterns.
Detects high-volume retrieval of secrets by a single principal within a one-hour window across AWS Secrets Manager, Azure Key Vault, and Google Cloud Secret Manager. This behavior is indicative of bulk credential harvesting or automated sensitive data exfiltration following unauthorized access or privilege escalation in cloud environments.
This rule detects potential privilege escalation in cloud environments (AWS, Azure, GCP) by identifying the attachment or update of overly permissive policies (e.g., wildcard permissions or administrative roles) followed by rapid execution of high-privilege actions (like creating new users, keys, or profiles) by the same actor within 15 minutes.
Detects anomalous GCP IAM Service Account Credential API calls where a principal impersonates multiple distinct service accounts within a short time window. This behavior often indicates a credential delegation chain or a multi-stage privilege escalation attempt within a GCP environment.
Detects unauthorized attempts to disable, suspend, or downgrade critical native cloud security and monitoring services (e.g., AWS GuardDuty, AWS Security Hub, Azure Defender for Cloud, and GCP Security Command Center). Attackers often perform these actions to evade detection of subsequent malicious activity within the cloud environment.
Detects the use of standard Linux command-line utilities (e.g., cat, curl, vi) to read or reference sensitive cloud credential files or Kubernetes service account tokens. This behavior is a common indicator of credential theft or discovery activities following initial access to a Linux host.
Detects anomalous authentication patterns where a single source IP targets a high number of unique user accounts with failed authentication attempts over a rolling window. By filtering out SSO/Federated methods and specific service account patterns, this rule isolates low-and-slow brute-force or password-spraying activities designed to evade standard account lockout mechanisms.
Detects anomalous authentication patterns associated with AI agent or service account credentials. The rule monitors for logins originating from multiple disparate network locations, ASNs, or countries within a 15-minute window, and detects unexpected MFA challenges directed at accounts that typically function as automated, headless identities.
Detects malicious attempts to delete or modify the access control settings of centralized cloud audit log storage, such as S3 buckets, Azure Log Analytics workspaces, or GCP log buckets. These actions aim to impair visibility into an adversary's activities, a common step in anti-forensics and data destruction workflows.
Detects the use of standard Linux command-line utilities (e.g., cat, curl, vi) to read or reference sensitive cloud credential files or Kubernetes service account tokens. This behavior is a common indicator of credential theft or discovery activities following initial access to a Linux host.
Detects potential session cookie replay attacks by identifying sign-in events using SSO or session tokens from different IP addresses, geographic locations, or devices compared to an established user baseline, without a corresponding fresh MFA challenge in the same timeframe. This behavior is indicative of unauthorized access to an already-authenticated session.
Detects attempts by potentially malicious processes, such as web-browsing tools, scripts, or agents, to access the cloud instance metadata service (169.254.169.254) or associated metadata paths. This behavior is indicative of Server-Side Request Forgery (SSRF) exploitation aimed at stealing cloud instance credentials.
This rule detects anomalous activity involving cloud-based shell services (AWS CloudShell, Azure Cloud Shell, GCP Cloud Shell). It triggers on two main conditions: (1) First-time usage of these shell environments by a principal within the detection window, and (2) The execution of commands associated with data staging, ingress tool transfer, or exfiltration (e.g., curl, wget, storage copy commands).
Detects modifications to security groups, network security groups (NSG), or firewall rules across AWS, Azure, and GCP that expose sensitive management or database ports (22, 3389, 3306, 5432, 6379, 9200, 27017) to the entire internet (0.0.0.0/0). Such configurations significantly increase the attack surface and potential for unauthorized access, brute-force attacks, or data exposure.
Detects the creation of a new application secret or credential in a cloud environment followed by an immediate authentication attempt using that credential from an IP address that has not been observed performing successful authentication within the specified lookback window. This behavior is indicative of potential unauthorized persistence or the use of compromised credentials by an adversary.
Detects unauthorized sharing, copying, or exporting of EBS, disk, or database snapshots to external cloud accounts, subscriptions, or projects that are not present in the defined trusted allow-list for AWS, Azure, or GCP environments.
Page 1 of 22