Browse Rules

[DARKTRACE] Potential Malicious Infrastructure Alert

[DARKTRACE] Potential Malicious Infrastructure Alert

The initialization of the tracing infrastructure failed

The initialization of the tracing infrastructure failed

AWS Modify Cloud Compute Infrastructure

Detection when EC2 compute infrastructure is modified outside of expected automation methods.

x509_public_key_infrastructure_cert [crypto]

AWS EC2 Download Instance User Data

An entity has accessed the user data scripts of multiple EC2 instances.

Dynatrace - Problem detection

'Detect application & infrastructure problems in your environment'

apt_hiddencobra_binaries [malware]

HIDDEN COBRA – North Korea’s DDoS Botnet Infrastructure

apt_hiddencobra_rsakey [malware]

HIDDEN COBRA – North Korea’s DDoS Botnet Infrastructure

apt_hiddencobra_urlbuilder [malware]

HIDDEN COBRA – North Korea’s DDoS Botnet Infrastructure

AWS Credentials Used from GitHub Actions and Non-CI/CD Infrastructure

Detects AWS access keys that are used from both GitHub Actions CI/CD infrastructure and non-CI/CD infrastructure. This pattern indicates potential credential theft where an attacker who has stolen AWS credentials configured as GitHub Actions secrets and is using them from their own infrastructure.

HKTL_NET_NAME_Infrastructure_Assessment [yara]

Detects .NET red/black-team tools via name

HKTL_NET_NAME_Infrastructure_Assessment [malware]

Detects .NET red/black-team tools via name

Azure Virtual Network Deleted

Detects when an Azure Virtual Network (VNet) is deleted. VNet deletion removes the entire network infrastructure and disconnects all resources within it, causing significant service disruption. This may indicate ransomware activity, sabotage, or unauthorized infrastructure destruction.

The infrastructure has reported that an attempt to trace an event has failed cause of lack of enough buffer space

The infrastructure has reported that an attempt to trace an event has failed cause of lack of enough buffer space

GCP Firewall Rule Created

This rule detects creations of GCP firewall rules.

GCP Firewall Rule Deleted

This rule detects deletions of GCP firewall rules.

GCP Firewall Rule Modified

This rule detects modifications to GCP firewall rules.

GCP Logging Sink Modified

This rule detects modifications to GCP Log Sinks.

The infrastructure has reported that the number of trace events that have been lost until now is equal to $(win.eventdata.data)

The infrastructure has reported that the number of trace events that have been lost until now is equal to $(win.eventdata.data)

Fortinet APT group abuse on Windows (task)

Detects scenarios where APT actors exploits Fortinet vulnerabilities to gain access into Windows infrastructure.

Fortinet APT group abuse on Windows (user)

Detects scenarios where APT actors exploits Fortinet vulnerabilities to gain access into Windows infrastructure.

GCP Log Bucket or Sink Deleted

This rule detects deletions of GCP Log Buckets or Sinks.

SureBackup Job Failed

Detects failed SureBackup job operations. This might indicate malware issues, storage problems, or potential sabotage of backup infrastructure.

Invoicera infrastructure abuse

This rule is tailored to flag infrastructural abuse involving Invoicera, a SaaS-based invoicing and billing platform, which has been identified as a tool in widespread spam and credential phishing campaigns.

Configuration Backup Failed

Detects failed configuration backup operations. This might indicate system or storage issues, or a potential sabotage of the backup infrastructure.