Every published rule

This rule detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken model safety controls and enable unsafe or unauthorized model responses.

This rule detects user has indicated they haven't instigated the MFA prompt and could indicate an adversary has the password for the account.

This rule detects when a Azure Kubernetes network policy is modified or deleted.

This rule detects potential full network packet capture in gcp. This feature can potentially be misused to read sensitive data from unencrypted internal traffic.

This rule detects when storage bucket is enumerated in Google Cloud.

This rule detects disabling of default Amazon Elastic Block Store (EBS) encryption in the current region. Disabling default encryption does not change the encryption status of your existing volumes.

This rule detects when a new credential is added to an existing application. Any additional credentials added outside of expected processes could be a hostile actor using those credentials.

This rule detects disabling of Multi Factor Authentication.

This rule detects when a Virtual Network is modified or deleted in Azure.

This rule detects when S3 bucket versioning is disabled. Threat actors use this method during AWS ransomware incidents prior to deleting S3 objects.

This rule detects when a Microsoft Cloud App Security reported a risky sign-in attempt due to a login linked with an impossible travel.

This rule detects resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly. The application then uses those credentials to authenticate the user against the identity provider.

This rule detects when legacy authentication has been used on an account

This rule detects the deletion of an AWS SAML provider, potentially suggesting hostile intent to disrupt administrative or security team access. An adversary can remove the SAML provider for the information security team or a team of system administrators, to make it difficult for them to work and investigate at the time of the attack and after it.

This rule detects when a virtual network device is being modified or deleted. This can be a network interface, network virtual appliance, virtual hub, or virtual router.

This rule detects when a Firewall Policy is Modified or Deleted.

This rule detects when a EFS Fileshare Mount is modified or deleted. An adversary breaking any file system using the mount target that is being deleted, which might disrupt instances or applications using those mounts.

This rule detects suggests anomalous rules such as an inbox rule that forwards a copy of all emails to an external address

This rule detects when a application gateway is modified or deleted.

This rule detects the deployment of workloads that are deployed by using the break-glass flag to override Binary Authorization controls.