Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
734 detections
Filters
Last updated
All Time
Detection languages
195
188
140
128
53
Contributors
229
147
111
94
34
Categories
613
214
127
93
73
Platforms
713
77
57
26
26
Products / Services
10,643
9,755
6,688
4,418
3,745
734
MITRE Techniques
294
276
143
124
106
CVEs
3
1
1
1
IDS Classtypes
5
5
4
2
IDS Protocols
16
Detects AWS OIDC role assumption by a GitHub workflow running on a ci-sync-<6 chars> branch followed within an hour by Secrets Manager reads using the same session credentials, as seen in the Gheist campaign.
Detects a suspicious behavioral sequence in AWS CloudTrail logs from external IPs using the Boto3 user agent. The sequence starts with caller-identity validation (GetCallerIdentity), followed by a high volume of secret reads (Secrets Manager) or cloud storage object reads (S3), indicating automated reconnaissance, credential theft, or data exfiltration.
Detects a sequence of AWS API calls where an external IP first calls sts:GetCallerIdentity, followed by Bedrock model listing APIs, and subsequently IAM or account/trail discovery events within a short timeframe, indicating potential cloud reconnaissance or unauthorized access.
This hunting query identifies successful AWS IAM access key creation events where a named IAM user creates a key for a different named IAM user.
Such activity may indicate persistence or privilege escalation, particularly when the target user has elevated permissions. The query compares the caller and target usernames; it does not assess the target user's permissions.
Hunting queries are designed to be run manually during threat hunting activities.
Such activity may indicate persistence or privilege escalation, particularly when the target user has elevated permissions. The query compares the caller and target usernames; it does not assess the target user's permissions.
Hunting queries are designed to be run manually during threat hunting activities.
Detects a sequence where an assumed-role credential from an external IP calls sts:GetCallerIdentity followed by listing Amazon Bedrock foundation models within a one-hour window, potentially indicating reconnaissance of AI/ML services by an external threat actor.
Detects a successful AWS IAM CreateRole event whose trust policy allows sts:AssumeRole by a principal in another AWS account or by a wildcard
principal.
This configuration may provide persistent access if the principal can assume the role. The event alone does not establish that the role was assumed or that its creation was unauthorized.
principal.
This configuration may provide persistent access if the principal can assume the role. The event alone does not establish that the role was assumed or that its creation was unauthorized.
Detects the weakening of "Block Public Access" setting of S3 buckets in CloudTrail logs.
Monitoring changes to Block Public Access settings is critical, as attackers may disable these safeguards before exposing a bucket through a public ACL or bucket policy.
Monitoring changes to Block Public Access settings is critical, as attackers may disable these safeguards before exposing a bucket through a public ACL or bucket policy.
Detects an AWS identity making 10 or more successful EC2 Instance ConnectSendSSHPublicKey API calls within the configured search interval.
EC2 Instance Connect temporarily makes an SSH public key available to an operating-system user on an EC2 instance.
A burst of these calls may indicate automated attempts to establish access or move laterally using compromised AWS credentials.
EC2 Instance Connect temporarily makes an SSH public key available to an operating-system user on an EC2 instance.
A burst of these calls may indicate automated attempts to establish access or move laterally using compromised AWS credentials.
The following analytic detects a high volume of Amazon CloudWatch Logs read operations performed by the same AWS principal and account within a
five-minute period.
It identifies more than 500 DescribeLogGroups, DescribeLogStreams, DownloadLogEvents, FilterLogEvents, GetLogEvents, or GetQueryResults API calls.
This activity may indicate automated discovery or collection of operational, application, or security telemetry from CloudWatch Logs.
five-minute period.
It identifies more than 500 DescribeLogGroups, DescribeLogStreams, DownloadLogEvents, FilterLogEvents, GetLogEvents, or GetQueryResults API calls.
This activity may indicate automated discovery or collection of operational, application, or security telemetry from CloudWatch Logs.
Detects when a single AWS user identity or IP address enumerates multiple resources across different AWS services (such as SQS, Lambda, ECS, CodeDeploy, S3, RDS, Athena) within a short time window, indicating potential reconnaissance or discovery activity.
The following analytic detects an AWS principal making more than 10 distinct successful Secrets Manager BatchGetSecretValue API calls within one hour. It groups calls by AWS account and user identity ARN and deduplicates CloudTrail events by event ID. Repeated batch retrieval may indicate bulk access to secrets using a compromised identity, although legitimate automation can produce similar activity.
A successful EC2 StopInstances request was followed within one hour by a successful ModifyInstanceAttribute request targeting userData on the same instance, by the same IAM principal.
This may indicate an attempt to change instance startup behavior or establish persistence.
These CloudTrail events do not confirm that the modified user-data script executed.
This may indicate an attempt to change instance startup behavior or establish persistence.
These CloudTrail events do not confirm that the modified user-data script executed.
The following analytic detects the creation of open/public S3 buckets via the AWS CLI.
It leverages AWS CloudTrail logs to identify events where a user has set bucket permissions to allow access to "AuthenticatedUsers" or "AllUsers." This activity is significant because open S3 buckets can expose sensitive data to unauthorized users, leading to data breaches.
If confirmed malicious, an attacker could gain unauthorized access to potentially sensitive information stored in the S3 bucket, posing a significant security risk.
It leverages AWS CloudTrail logs to identify events where a user has set bucket permissions to allow access to "AuthenticatedUsers" or "AllUsers." This activity is significant because open S3 buckets can expose sensitive data to unauthorized users, leading to data breaches.
If confirmed malicious, an attacker could gain unauthorized access to potentially sensitive information stored in the S3 bucket, posing a significant security risk.
The following analytic detects unauthorized container uploads to AWS Elastic Container Service (ECR) by monitoring AWS CloudTrail events.
It identifies instances where a new container is uploaded by a user not previously recognized as authorized.
It identifies instances where a new container is uploaded by a user not previously recognized as authorized.
Detects the rare 'AssumeRoot' event in AWS STS followed by high-impact administrative or destructive API calls within a one-hour window. This behavior often indicates an adversary attempting to gain elevated, privileged access to perform unauthorized actions such as disabling logging, deleting infrastructure, or modifying IAM policies.
Detects high-volume retrieval of secrets by a single principal within a one-hour window across AWS Secrets Manager, Azure Key Vault, and Google Cloud Secret Manager. This behavior is indicative of bulk credential harvesting or automated sensitive data exfiltration following unauthorized access or privilege escalation in cloud environments.
This rule detects potential privilege escalation in cloud environments (AWS, Azure, GCP) by identifying the attachment or update of overly permissive policies (e.g., wildcard permissions or administrative roles) followed by rapid execution of high-privilege actions (like creating new users, keys, or profiles) by the same actor within 15 minutes.
Detects chained AWS STS AssumeRole/AssumeRoleWithSAML/AssumeRoleWithWebIdentity events where a principal assumes a role in a different account and then quickly performs another role assumption from that new context. This pattern, often referred to as 'role chaining' or 'role laundering', is frequently used to obfuscate identity tracking and facilitate lateral movement across AWS account boundaries.
The following analytic detects cloud provisioning activities originating from previously unseen countries. It leverages cloud infrastructure logs and compares the geographic location of the source IP address against a baseline of known locations. This activity is significant as it may indicate unauthorized access or potential compromise of cloud resources. If confirmed malicious, an attacker could gain control over cloud assets, leading to data breaches, service disruptions, or further infiltration into the network.
Detects anomalous AWS Bedrock activity indicative of LLMjacking by correlating multiple phases of an attack chain (Model Enablement, Reconnaissance, Probing, and Execution) performed by a single identity within a short timeframe. This rule identifies attackers leveraging stolen IAM credentials to discover available AI models, probe for vulnerabilities, and execute unauthorized inference requests at scale.
The following analytic detects cloud API calls executed by user roles that have not previously run these commands. It leverages the Change data model in Splunk to identify commands executed by users with the user_type of AssumedRole and a status of success. This activity is significant because new commands from different user roles can indicate potential malicious activity or unauthorized actions. If confirmed malicious, this behavior could lead to unauthorized access, data breaches, or other damaging outcomes by exploiting new or unmonitored commands within the cloud environment.
Page 1 of 35