Browse Rules

AWS CloudTrail EC2 Subnet Deleted

Detects when an attacker is destroying an EC2 subnet.

AWS CloudTrail IAM Password Policy Updated

Detects an update to the password policy. This could be an attempt to lower accounts security level.

AWS CloudTrail Route 53 Domain Transfer Lock Disabled

Detects when the transfer lock feature is disabled on a domain name handled by AWS Route 53 service.

AWS CloudTrail S3 Bucket Replication

Detects a replication rule being enable for a given S3 bucket: it could provide an attacker a way to exfiltrate data.

HTML Smuggling Suspicious Usage

Based on several samples from different Botnets, this rule aims at detecting HTML infection chain by looking for HTML created files followed by suspicious files being executed.

AWS CloudTrail EC2 Enable Serial Console Access

Detects when the EC2 serial console access feature is enabled. This could abused by some attackers to avoid network detection when accessing to EC2 instances.

AWS S3 Static Site JavaScript File Uploaded

This rule detects when a JavaScript file is uploaded in an S3 static site directory (`static/js/`) by an IAM user or assumed role. This can indicate suspicious modification of web content hosted on S3, such as injecting malicious scripts into a static website frontend.

Salesforce Third-Party Integration Monitoring

Monitors third-party integrations and OAuth connected apps accessing Salesforce. Connected apps use OAuth for authorization and can access data on behalf of users, making them a potential vector for: - Unauthorized data access - Shadow IT applications - Compromised OAuth tokens - Over-privileged integrations This detection triggers on connected app usage events and adjusts severity based on: - Connection type (refresh tokens are higher risk) - App authorization events - Suspicious app naming pa

AWS WAF Access Control List Deletion

Identifies the deletion of an AWS Web Application Firewall (WAF) Web ACL. Web ACLs are the core enforcement objects in AWS WAF, defining which traffic is inspected, allowed, or blocked for protected applications. Deleting a Web ACL removes all associated rules, protections, and logging configurations. Adversaries who obtain sufficient privileges may delete a Web ACL to disable critical security controls, evade detection, or prepare for downstream attacks such as web-application compromise, data