Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,050 copies47 likes38,351 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the creation of new AWS IAM access keys, with specific filtering for cross-principal creation, creation for sensitive accounts (e.g., service, admin), or excessive key creation activity. This pattern is often used by adversaries for persistence or privilege escalation in cloud environments.
This rule detects suspicious activities targeting cloud management hierarchy, specifically identifying attempts to remove AWS accounts from organizations, disable policy enforcement, create rogue accounts, or hijack Azure subscriptions through unauthorized transfers or tenant changes. Such actions are often used by adversaries to bypass security guardrails, remove organizational visibility, or establish persistent unauthorized access within a cloud environment.
Detects unauthorized attempts to disable, delete, or weaken AWS CloudTrail logging and supporting infrastructure. This includes stopping log delivery, deleting trails, reducing scope via event selectors, removing VPC flow logs or CloudWatch log groups, and unauthorized administrative actions against the S3 bucket designated for CloudTrail logs.
Detects high-privilege IAM role assignments in Google Cloud Platform and Microsoft Azure environments. The rule specifically monitors for assignments of overly permissive roles (e.g., Owner, Global Administrator, or wildcard actions) that could allow for full environment compromise or persistence.
Detects the deployment of virtual machines with public IP addresses (in Azure) or compute instances with external IP addresses (in GCP) by a single principal within a 15-minute window. This behavior is indicative of a newly-privileged identity or an compromised account establishing externally-accessible infrastructure for further malicious activity.
Detects potential abuse of Cloud Shell to persist access in cloud environments. For GCP, it monitors the injection of SSH keys into instance or project metadata from a Cloud Shell session. For Azure, it detects a pattern involving Cloud Shell storage provisioning followed by a subsequent VM run-command or SSH public key update, indicating potential unauthorized management of virtual machines.
Detects the creation of new service principal credentials in Azure AD or GCP service account keys targeting identities holding highly privileged administrative roles. This behavior is indicative of a persistence mechanism where an adversary establishes long-term access to a cloud environment by creating new, controlled credentials for an existing privileged identity.
Detects instances where a user has consented to an OAuth application that requests high-privilege Microsoft Graph scopes (Directory.Read.All, User.Read.All, Mail.Read). This pattern is indicative of consent phishing attacks where adversaries trick users into granting applications excessive permissions, bypassing administrative consent workflows when tenant configurations allow user-level consent.
Detects changes to federation settings on an Entra ID domain, including modifications to IssuerUri, ActiveLogOnUri, MetadataExchangeUri, or SigningCertificate, as well as transitions between Managed and Federated authentication types. Such changes can facilitate 'Golden SAML' attacks by allowing an adversary to forge authentication tokens for the tenant.
Detects changes to federation settings on an Entra ID domain, including modifications to IssuerUri, ActiveLogOnUri, MetadataExchangeUri, or SigningCertificate, as well as transitions between Managed and Federated authentication types. Such changes can facilitate 'Golden SAML' attacks by allowing an adversary to forge authentication tokens for the tenant.
Page 73 of 1168