Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
70 detections
Filters
Last updated
All Time
Detection languages
42
10
9
4
3
Contributors
39
14
11
3
1
Categories
25
22
12
11
10
Platforms
51
11
10
9
8
Products / Services
10,650
9,755
6,688
4,418
3,745
MITRE Techniques
20
18
17
17
14
CVEs
1
1
1
IDS Classtypes
4
4
1
IDS Protocols
9
Detects malicious attempts to delete or modify the access control settings of centralized cloud audit log storage, such as S3 buckets, Azure Log Analytics workspaces, or GCP log buckets. These actions aim to impair visibility into an adversary's activities, a common step in anti-forensics and data destruction workflows.
Detects unauthorized attempts to modify or delete AWS CloudTrail logs stored in S3, or changes to the S3 bucket lifecycle configuration that would shorten the log retention period. This activity is indicative of an adversary attempting to clear their tracks or hinder audit capabilities.
Detects anomalous, unauthorized access to machine learning model artifacts (e.g., .onnx, .pt, .h5) within object storage or model registries. The rule identifies suspicious patterns including high-volume file reads by non-ML team identities, lack of multi-factor authentication, or access from geolocations outside approved operating regions, indicative of potential model exfiltration or intellectual property theft.
Detects malicious attempts to delete or modify the access control settings of centralized cloud audit log storage, such as S3 buckets, Azure Log Analytics workspaces, or GCP log buckets. These actions aim to impair visibility into an adversary's activities, a common step in anti-forensics and data destruction workflows.
Detects unauthorized attempts to delete CloudTrail log files or destroy the underlying storage bucket used for logs. This activity is a form of anti-forensics intended to remove evidence of malicious activity within the cloud control plane. The detection excludes legitimate automated S3 lifecycle management events.
Detects unauthorized attempts to delete CloudTrail log files or destroy the underlying storage bucket used for logs. This activity is a form of anti-forensics intended to remove evidence of malicious activity within the cloud control plane. The detection excludes legitimate automated S3 lifecycle management events.
Detects potential ransomware activity in AWS by identifying high volumes of S3 object encryption (using SSE-C or KMS) followed by the disabling or scheduled deletion of the associated KMS key material. This behavior aims to render data inaccessible to legitimate users while ensuring recovery is inhibited by destroying the cryptographic keys required for decryption.
This rule detects the unauthorized download of complete ML model checkpoint or weight files from a model registry or object storage. It monitors for common model file extensions in download events that are not associated with a legitimate deployment justification or a pre-approved change management window, helping to identify potential intellectual property theft or model exfiltration attempts.
Detects anomalous, unauthorized access to machine learning model artifacts (e.g., .onnx, .pt, .h5) within object storage or model registries. The rule identifies suspicious patterns including high-volume file reads by non-ML team identities, lack of multi-factor authentication, or access from geolocations outside approved operating regions, indicative of potential model exfiltration or intellectual property theft.
Detects data transfer to potentially attacker-controlled cloud accounts
Detects S3 bucket lifecycle policies configured for automatic object deletion
This rule detects suspicious activities related to AWS S3 buckets that could indicate a bucket hijacking attempt or unauthorized replication to an external account. Specifically, it looks for two scenarios: 1) an S3 bucket being deleted and then recreated by a different AWS account within a one-hour window, suggesting a namespace hijacking, or 2) an S3 bucket being deleted while a PutBucketReplication event references an external AWS account, indicating an attempt to exfiltrate data or maintain access through replication.
This rule detects suspicious activities related to AWS S3 buckets that could indicate a bucket hijacking attempt or unauthorized replication to an external account. Specifically, it looks for two scenarios: 1) an S3 bucket being deleted and then recreated by a different AWS account within a one-hour window, suggesting a namespace hijacking, or 2) an S3 bucket being deleted while a PutBucketReplication event references an external AWS account, indicating an attempt to exfiltrate data or maintain access through replication.
Detects potential S3 bucket exfiltration attempts originating from command-line interface (CLI) tools or Node.js applications. The rule specifically looks for network connections to AWS S3 regional endpoints (us-west or us-east) initiated by processes named 'node.exe', 'python.exe', or 'aws.exe'.
Detects bulk download of AWS S3 objects indicating cloud data theft
Detects bulk download of AWS S3 objects indicating cloud data theft
Detects enumeration of S3 bucket objects for cloud data discovery
Detects upload of offensive security tools to cloud storage for staging
This rule detects attempts to enumerate AWS S3 buckets by making HTTP requests to s3.amazonaws.com with the '?list-type=2' parameter in the URI. This type of request is commonly used to list the contents of an S3 bucket.
This rule detects HTTP PUT requests to Amazon S3 or Azure Blob Storage (cloud storage services) where the request body size is between 100 and 2000 bytes. This pattern is often indicative of one-way command and control (C2) communication, where an attacker might be exfiltrating small chunks of data or sending commands to a compromised host via cloud storage. The thresholding mechanism (20 events within 300 seconds from the same source) aims to reduce alerts from legitimate, infrequent cloud storage interactions.
This rule detects attempts to set or modify an S3 bucket lifecycle policy for auto-deletion. It specifically looks for HTTP PUT requests to 's3.amazonaws.com' with a URI containing '?lifecycle'. This activity could indicate an attacker attempting to delete data after exfiltration or to destroy evidence.
Page 1 of 4