Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,056 copies47 likes38,421 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects AWS CloudTrail events where VPC Flow Logs are disabled or deleted, potentially indicating an adversary attempting to evade network monitoring by blinding detection mechanisms for lateral movement or data exfiltration.
Detects the attachment of the 'AdministratorAccess' managed policy or custom policies with wildcard actions and resources to AWS IAM users, roles, or groups. This activity is a critical indicator of privilege escalation, often serving as the final step in gaining full control of an AWS account by an adversary.
Detects unauthorized or suspicious modifications to AWS GuardDuty, including detector deletion, disabling of the service, disassociation from the master account, or the creation of suppression filters that archive findings, all of which indicate potential defense evasion by an adversary.
Detects the creation of a new AWS IAM policy version with 'SetAsDefault' enabled, specifically where the policy document contains overly permissive wildcard actions, resources, or full IAM administrative privileges. This technique allows an attacker to escalate privileges by modifying an existing policy version without updating the attachment status, effectively bypassing standard monitoring of policy attachments.
Detects the attachment of the 'AdministratorAccess' managed policy or custom policies with wildcard actions and resources to AWS IAM users, roles, or groups. This activity is a critical indicator of privilege escalation, often serving as the final step in gaining full control of an AWS account by an adversary.
This rule detects the use of browser-based cloud shells (AWS CloudShell, Azure Cloud Shell) as an entry point for post-exploitation activities, specifically tracking when these sessions are followed by object storage operations (S3 PutObject/GetObject or equivalent Azure Blob operations) within the same session context. This pattern is indicative of attackers using ephemeral cloud shells to stage stolen data or download offensive tooling, thereby bypassing host-based EDR monitoring.
Detects unauthorized attempts to delete CloudTrail log files or destroy the underlying storage bucket used for logs. This activity is a form of anti-forensics intended to remove evidence of malicious activity within the cloud control plane. The detection excludes legitimate automated S3 lifecycle management events.
Detects the creation of a new AWS IAM policy version with 'SetAsDefault' enabled, specifically where the policy document contains overly permissive wildcard actions, resources, or full IAM administrative privileges. This technique allows an attacker to escalate privileges by modifying an existing policy version without updating the attachment status, effectively bypassing standard monitoring of policy attachments.
Detects the attachment of the 'AdministratorAccess' managed policy or custom policies with wildcard actions and resources to AWS IAM users, roles, or groups. This activity is a critical indicator of privilege escalation, often serving as the final step in gaining full control of an AWS account by an adversary.
Detects the creation of a new AWS IAM policy version with 'SetAsDefault' enabled, specifically where the policy document contains overly permissive wildcard actions, resources, or full IAM administrative privileges. This technique allows an attacker to escalate privileges by modifying an existing policy version without updating the attachment status, effectively bypassing standard monitoring of policy attachments.
Page 151 of 1168