Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,050 copies47 likes38,351 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the creation or modification of AWS IAM policies that grant administrative-level access (Action '*' on Resource '*') to a role, user, or group. This is a common technique used by attackers to gain or escalate privileges to full administrator access following initial foothold acquisition.
Detects potential privilege escalation sequences in AWS where an identity uses 'iam:PassRole' in conjunction with resource-creation APIs (such as 'lambda:CreateFunction', 'ec2:RunInstances', or 'cloudformation:CreateStack'). This pattern is indicative of an attacker attempting to attach a higher-privileged role to a newly created resource under their control, allowing them to perform actions beyond their current scope.
Detects the modification of AWS Security Groups where management ports (SSH, RDP, WinRM, or common database ports) are opened to the entire internet (0.0.0.0/0 or ::/0). This activity is indicative of creating a network-layer backdoor to maintain persistence or facilitate lateral movement within a cloud environment.
Detects the creation of an AWS IAM access key (CreateAccessKey) for the root account or identities with administrative naming conventions. This activity can indicate persistence establishment by an attacker who has gained high-privileged access, as new access keys provide a durable way to maintain programmatic control that bypasses standard session-based security controls.
Detects the deletion of Azure Monitor diagnostic settings or log profiles that export subscription-level Activity Logs. This action disables logging, effectively blinding security visibility into tenant operations, and is often used by adversaries as a defense-evasion technique before conducting further malicious activities.
Detects Azure Activity Log events where a Storage Account is modified to enable public network access, public blob access, or container-level public access. Such misconfigurations can lead to unauthorized data exposure and exfiltration by internet-based actors.
Detects the creation or modification of Kubernetes RoleBindings or ClusterRoleBindings that grant highly privileged roles (e.g., cluster-admin or wildcard permissions) to a subject. The detection includes behavioral analysis to identify ServiceAccount usage from unusual source IP addresses within a short timeframe, which may indicate account compromise and unauthorized privilege escalation.
Detects the provisioning of high-performance compute instances (GPU or high-CPU) in AWS regions that fall outside of an established organizational baseline. This behavior is often associated with unauthorized resource hijacking (cryptomining) by adversaries leveraging compromised IAM principals to deploy infrastructure in regions with lower visibility or monitoring coverage.
This rule detects modifications to AWS IAM policies via PutUserPolicy, PutRolePolicy, AttachUserPolicy, or AttachRolePolicy where the policy grants excessive permissions (wildcard Actions and Resources) or attaches an AdministratorAccess policy. The rule also flags rapid escalations occurring within 15 minutes of new user, role, or access key creation to identify potential self-escalation or unauthorized privilege escalation attempts by existing identities.
Detects modifications to AWS S3 bucket policies, access control lists (ACLs), or public access block configurations that result in public bucket exposure. The rule specifically flags broad permissions such as 'AllUsers' or wildcard principal entities, and correlates these findings with AWS Config or Access Analyzer data to confirm public reachability.
Page 72 of 1168