Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,306 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule identifies potential account compromise through the detection of non-interactive Azure AD sign-ins originating from geographically distant locations within a short, travel-implausible timeframe. Such activity is highly indicative of the theft and export of a Primary Refresh Token (PRT) from a legitimate endpoint, which is subsequently replayed by an adversary from external infrastructure to gain unauthorized access to cloud resources.
Detects the initialization of an AWS CloudShell environment or session. Attackers often abuse CloudShell as a managed, agentless environment within the provider's infrastructure to stage tools, perform reconnaissance using the AWS CLI, and exfiltrate data while bypassing standard endpoint-based detection.
Detects modifications to AWS S3 bucket policies, ACLs, or public access block settings that result in a bucket becoming publicly accessible. Attackers often leverage s3:PutBucketPolicy or similar permissions to make buckets public, allowing data exfiltration via anonymous HTTP requests and bypassing egress monitoring for direct API calls.
Detects modifications to cloud storage configurations in Azure and GCP that grant public access to containers or blobs. Attackers may leverage this to expose sensitive data stored in cloud environments by changing permissions to be publicly readable.
Detects usage of AWS CloudShell followed by S3 data-plane activity (GetObject/PutObject) from users without a documented baseline or exhibiting geographic anomalies. This pattern is indicative of potential misuse of a pre-authenticated execution context to perform unauthorized data staging or access, often evading host-based EDR monitoring.
Detects unauthorized attempts to modify or delete AWS CloudTrail logs stored in S3, or changes to the S3 bucket lifecycle configuration that would shorten the log retention period. This activity is indicative of an adversary attempting to clear their tracks or hinder audit capabilities.
Detects instances where a principal utilizes the iam:PassRole permission to assign a role with higher privileges to a newly created or updated compute resource (Lambda or EC2), potentially allowing the principal to assume the identity and elevated permissions of the passed role.
Detects unauthorized sharing of AWS EBS snapshots or RDS snapshots to external, unapproved AWS accounts. This activity is often a precursor to data exfiltration, where an adversary creates a snapshot of a production resource and shares it with an account under their control to bypass existing identity-based access controls.
Detects unauthorized or risky configuration changes in Google Cloud Storage or Azure Storage accounts that grant public access (e.g., allUsers/allAuthenticatedUsers or public blob access) specifically on storage resources identified as production or sensitive (PII/financial data).
Detects the assignment of high-privilege application permissions (e.g., Mail.ReadWrite, full_access_as_app, Files.ReadWrite.All, Sites.FullControl.All) to a service principal. This pattern is indicative of an attacker who has compromised an Application Administrator account and is attempting to establish long-term, unattended access to cloud resources such as mailboxes and SharePoint sites via OAuth client-credential flows.
Page 42 of 1168