Every published rule

This rule detects when a firewall is created, modified, or deleted.

This rule detects the execution of TruffleHog, a popular open-source tool used for scanning repositories for secrets and sensitive information, within an AWS environment. It has been reported to be used by threat actors for credential harvesting. All detections should be investigated to determine if the use is authorized by security teams or potentially malicious.

This rule detects suggests sign-ins from an anonymous IP address, for example, using an anonymous browser or VPN.

This rule detects the addition of a new network route to a route table in AWS.

This rule detects when an instance identity has taken an action that isn't inside SSM. This can indicate that a compromised EC2 instance is being used as a pivot point.

This rule detects when a Microsoft Cloud App Security reported users were active from an IP address identified as risky by Microsoft Threat Intelligence. These IP addresses are involved in hostile activities, such as Botnet C&C, and may indicate compromised account.

This rule detects when Rule Collections (Application, NAT, and Network) is being modified or deleted.

This rule detects when ClusterRoles/Roles are being modified or deleted.

This rule detects when an end user consents to an application

This rule detects an instance of an SES identity being deleted via the "DeleteIdentity" event. This may be an indicator of an adversary removing the account that carried out anomalous or hostile activities

This rule detects group membership removal of groups that have CA policy modification access

This rule detects suggests sign-ins from IP addresses infected with malware that is known to actively communicate with a bot server.

This rule detects when a Google Cloud Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that generates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be leveraged to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is leveraged to schedule Jobs. An Adversary may use Kubernetes CronJob for scheduling execution of hostile code that would run as a container in the cluster.

This rule detects when DNS zone is modified or deleted.

This rule detects changes to the security groups linked with an Elastic Load Balancer (ELB) or Application Load Balancer (ALB). This can indicate that a misconfiguration allowing more traffic into the system than required, or could indicate that an adversary is attempting to enable new connections into a VPC or subnet controlled by the account.

This rule detects when a service account is disabled or deleted in Google Cloud.

This rule detects when a network security configuration is modified or deleted.

This rule detects when a Azure Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that generates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be leveraged to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is leveraged to schedule Jobs. An Adversary may use Kubernetes CronJob for scheduling execution of hostile code that would run as a container in the cluster.

This rule detects possible anomalous glue development endpoint activity.

This rule detects define a baseline threshold for failed sign-ins due to Conditional Access failures