Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,056 copies47 likes38,421 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects unauthorized attempts to delete CloudTrail log files or destroy the underlying storage bucket used for logs. This activity is a form of anti-forensics intended to remove evidence of malicious activity within the cloud control plane. The detection excludes legitimate automated S3 lifecycle management events.
This rule detects the use of browser-based cloud shells (AWS CloudShell, Azure Cloud Shell) as an entry point for post-exploitation activities, specifically tracking when these sessions are followed by object storage operations (S3 PutObject/GetObject or equivalent Azure Blob operations) within the same session context. This pattern is indicative of attackers using ephemeral cloud shells to stage stolen data or download offensive tooling, thereby bypassing host-based EDR monitoring.
Detects modifications to AWS IAM role trust policies (UpdateAssumeRolePolicy) that introduce wildcard principals, external AWS account ARNs, or federated identity providers (SAML/OIDC). This behavior is indicative of cross-tenant persistence or backdooring, enabling an adversary to assume privileged roles from an external account without creating local credentials.
Detects the launch of compute-optimized or GPU-accelerated EC2 instances via the RunInstances API. This behavior is a common indicator of unauthorized resource hijacking, such as cryptomining, where attackers leverage compromised credentials to deploy resource-intensive workloads in regions that have not been historically used by the organization.
This rule detects the launch of an AWS EC2 instance that is configured with an IAM instance profile containing administrative keywords (e.g., AdministratorAccess, FullAccess) or a wildcard (*). Attackers can abuse this configuration after gaining initial access to the console or API to attach an over-privileged profile to a new instance, then pivot to the instance metadata service (IMDS) to extract these administrative credentials for persistent, broadly-scoped access.
Detects the creation of AWS Lambda functions by non-standard principals that assign an execution role with potentially broader privileges than the creator, indicative of an IAM privilege escalation technique where an attacker abuses iam:PassRole and lambda:CreateFunction to execute code under an elevated identity.
Detects modifications to RDS or Aurora snapshot attributes that grant public access ('all') or share the snapshot with an external AWS account ID. This activity indicates a potential data exfiltration attempt, as sharing a snapshot allows an external party to restore the database in their own environment, bypassing existing application-layer access controls.
Detects modifications to AWS S3 bucket policies, ACLs, or public access block settings that result in the bucket becoming publicly accessible. This covers PutBucketPolicy actions with wide-open principals, PutBucketAcl actions granting access to global groups (AllUsers or AuthenticatedUsers), and disabling the 'Block Public Access' feature.
Detects the creation of an AWS IAM access key followed immediately by the use of that key from a new or anomalous geolocation, which is a strong indicator of credential theft or unauthorized key generation for persistence.
Detects the creation or modification of AWS Lambda functions that are associated with high-privilege IAM actions and triggered by EventBridge rules monitoring sensitive events like IAM user creation or console logins. This pattern indicates an attempt to establish event-driven, persistent backdoors within the AWS environment by automating malicious actions on new users or logins.
Page 152 of 1168