Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,056 copies47 likes38,424 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects modifications to EBS snapshot attributes via ModifySnapshotAttribute where the snapshot is made publicly accessible (all group) or shared with an unauthorized AWS account ID, potentially indicating unauthorized exfiltration of disk contents.
Detects the use of iam:CreatePolicyVersion and iam:SetDefaultPolicyVersion API calls, which are critical IAM actions that can be abused to escalate privileges by defining a new version of an IAM policy with excessive permissions and setting it as the default.
Detects rapid, large-scale deployment of high-vCPU/GPU compute instances, potentially indicating resource hijacking for cryptomining. The rule correlates high-compute instance launches with preceding AWS service quota increases, identifying potential malicious activity within an AWS environment.
Detects administrative actions intended to disable, modify, or suppress logging and alerting capabilities within AWS and Azure, specifically targeting services like Amazon GuardDuty, AWS Security Hub, AWS Config, and Microsoft Defender for Cloud. Such actions are frequently observed as a precursor to unauthorized activity to hide malicious actions from detection systems.
Detects successful AWS STS AssumeRole, AssumeRoleWithSAML, or AssumeRoleWithWebIdentity calls originating from an AWS account ID not included in the 'trusted_aws_accounts' lookup. The rule further enriches events with geolocation and ASN data to flag potential cross-account activity from high-risk or unexpected regions.
Detects anomalous cloud authentication activity where an OIDC provider is created or its thumbprint is updated, followed by an 'AssumeRoleWithWebIdentity' call originating from a GitHub Actions subject claim that does not match authorized repository or branch patterns. This often indicates an adversary abusing OIDC trust relationships to gain unauthorized access to high-privileged roles, frequently linked to subsequent IAM policy modifications like 'setIamPolicy' in GCP to grant persistent 'owner' access.
Detects potential ransomware activity in AWS by identifying high volumes of S3 object encryption (using SSE-C or KMS) followed by the disabling or scheduled deletion of the associated KMS key material. This behavior aims to render data inaccessible to legitimate users while ensuring recovery is inhibited by destroying the cryptographic keys required for decryption.
Detects the creation of an AWS CloudShell environment followed by a high volume of file transfer activity (PutFile, GetFile, or PutObject) by the same user within a short time window. This pattern is indicative of potential initial access or abuse of CloudShell for tool staging or unauthorized data exfiltration.
Detects the attachment or creation of IAM policies that grant administrative access (via 'AdministratorAccess' policy name) or full wildcard permissions ('Action': '*', 'Resource': '*') to users, roles, or groups. This activity is a common indicator of privilege escalation following a cloud identity compromise, frequently observed in campaigns by threat actors such as Scattered Spider (UNC3944).
Detects anomalous GCP IAM Service Account Credential API calls where a principal impersonates multiple distinct service accounts within a short time window. This behavior often indicates a credential delegation chain or a multi-stage privilege escalation attempt within a GCP environment.
Page 153 of 1168