Browse Rules

Search and filter across all detection sources

250 rules

sagan informational other

[GCP] Multiple SecretManager Secrets Deleted

[GCP] Multiple SecretManager Secrets Deleted
panther high python

Decoy Secret Accessed

Actor accessed Secrets Manager decoy secret
chronicle high yara-l

GCP Multiple Secrets Deleted

Detect when multiple secrets or secret versions are deleted from GCP Secret Manager.
panther informational python

EC2 Secrets Manager Retrieve Secrets

An attacker attempted to retrieve a high number of Secrets Manager secrets, through secretsmanager:GetSecretValue.
anvilogic high other

EC2 secrets and parameters dumping [snowflake-awscloudtrail]

Enumerate secrets in AWS Secrets Manager and AWS Systems manager parameter store. Secrets Manager helps you improve the security posture of your organization. Secrets include database credentials, passwords, and third-party API keys. You can use Secrets Manager to store secrets centrally, encrypt secrets automatically, control access to secrets, and rotate secrets safely and automatically
anvilogic high spl

EC2 secrets and parameters dumping [splunk-ec2]

Enumerate secrets in AWS Secrets Manager and AWS Systems manager parameter store. Secrets Manager helps you improve the security posture of your organization. Secrets include database credentials, passwords, and third-party API keys. You can use Secrets Manager to store secrets centrally, encrypt secrets automatically, control access to secrets, and rotate secrets safely and automatically
panther medium python

GitHub Secret Scanning Alert Created

GitHub detected a secret and created a secret scanning alert.
sigma low sigma

Kubernetes Secrets Enumeration

Detects enumeration of Kubernetes secrets.
panther informational python

AWS Secrets Manager Batch Retrieve Secrets

An attacker attempted to retrieve a high number of Secrets Manager secrets by batch, through secretsmanager:BatchGetSecretValue (released Novemeber 2023). An attacker may attempt to retrieve a high number of secrets by batch, to avoid detection and generate fewer calls. Note that the batch size is limited to 20 secrets.

panther medium python

Wiz Rotate Service Account Secret

This rule detects service account secrets rotations.
sagan informational other

[AWS-SECRETSMANAGER] BatchGetSecretValue Event Detected

[AWS-SECRETSMANAGER] BatchGetSecretValue Event Detected
sagan informational other

[AWS-SECRETSMANAGER] CancelRotateSecret Event Detected

[AWS-SECRETSMANAGER] CancelRotateSecret Event Detected
sagan informational other

[AWS-SECRETSMANAGER] DeleteResourcePolicy Event Detected

[AWS-SECRETSMANAGER] DeleteResourcePolicy Event Detected
sagan informational other

[AWS-SECRETSMANAGER] DeleteSecret Event Detected

[AWS-SECRETSMANAGER] DeleteSecret Event Detected
sagan informational other

[AWS-SECRETSMANAGER] ListSecretVersionIds Event Detected

[AWS-SECRETSMANAGER] ListSecretVersionIds Event Detected
sagan informational other

[AWS-SECRETSMANAGER] PutResourcePolicy Event Detected

[AWS-SECRETSMANAGER] PutResourcePolicy Event Detected
sagan informational other

[AWS-SECRETSMANAGER] PutSecretValue Event Detected

[AWS-SECRETSMANAGER] PutSecretValue Event Detected
sagan informational other

[AWS-SECRETSMANAGER] ReplicateSecretToRegions Event Detected

[AWS-SECRETSMANAGER] ReplicateSecretToRegions Event Detected
sagan informational other

[AWS-SECRETSMANAGER] RestoreSecret Event Detected

[AWS-SECRETSMANAGER] RestoreSecret Event Detected
sagan informational other

[AWS-SECRETSMANAGER] RotateSecret Event Detected

[AWS-SECRETSMANAGER] RotateSecret Event Detected
sagan informational other

[AWS-SECRETSMANAGER] UpdateSecret Event Detected

[AWS-SECRETSMANAGER] UpdateSecret Event Detected
sagan medium other

[EXTRAHOP] Impacket SecretsDump MMCExec Activity

[EXTRAHOP] Impacket SecretsDump MMCExec Activity
wazuh informational xml

Docker: Group of Docker secret events

Docker: Group of Docker secret events
hayabusa high sigma

Possible Impacket SecretDump Remote Activity

Detect AD credential dumping using impacket secretdump HKTL
sigma medium sigma

Kubernetes Secrets Modified or Deleted

Detects when Kubernetes Secrets are Modified or Deleted.