Every published rule

This rule detects IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.

This rule detects AWS Config Service disabling

This rule detects when an an application is removed from Google Workspace.

This rule detects when a privilege role can be activated without performing mfa.

This rule detects when a user is added to a privileged role.

This rule detects when an ElastiCache security group has been modified or deleted.

This rule detects when a EFS Fileshare is modified or deleted. You can't delete a file system that is in use. If the file system has any mount targets, the adversary must first delete them, so deletion of a mount will occur before deletion of a fileshare.

This rule detects successful AWS console logins that were performed without Multi-Factor Authentication (MFA). This alert can be leveraged to identify potential unauthorized access attempts, as logging in without MFA can indicate compromised credentials or misconfigured security settings.

This rule detects when a Azure Kubernetes Cluster is created or deleted.

This rule detects when anomalous SAML behavior has occurred in AWS. An adversary could gain backdoor access via SAML.

This rule detects the recovery of a new public database instance from a snapshot. It may be a part of data exfiltration.

This rule detects when a device in azure is no longer managed or compliant

This rule detects modifications to an RDS cluster or its deletion, which may indicate potential data exfiltration attempts, unauthorized access, or exposure of sensitive information.

This rule detects when an a role privilege is deleted in Google Workspace.

This rule detects when sensitive information is re-identified in google Cloud.

This rule detects the anomalous use of AssumeRole. Adversaries could move laterally and escalate privileges.

This rule detects suggests user behavior that is unusual for the user or consistent with known attack patterns.

This rule detects the import or deletion of key material in AWS KMS, that can be used as part of ransomware attacks. This behavior is uncommon and provides a high certainty signal.

This rule detects when an access level is changed for a Google workspace application. An access level is part of BeyondCorp Enterprise which is Google Workspace's way of enforcing Zero Trust model. An adversary would be able to remove access levels to gain easier access to Google workspace resources.

This rule detects when a user attached a Lambda layer to an existing Lambda function. A hostile Lambda layer could execute arbitrary code in the context of the function's IAM role. This would give an adversary access to resources that the function has access to.