Browse Rules

Search and filter across all detection sources

152 rules

wazuh informational xml

AWS GuardDuty alert.

AWS GuardDuty alert.
sagan low other

AWS GuardDuty detected

AWS GuardDuty detected
wazuh informational xml

AWS GuardDuty: $(aws.service.action.actionType) - $(aws.title)

AWS GuardDuty: $(aws.service.action.actionType) - $(aws.title)
wazuh low xml

AWS GuardDuty: $(aws.service.action.actionType) - $(aws.title)

AWS GuardDuty: $(aws.service.action.actionType) - $(aws.title)
wazuh medium xml

AWS GuardDuty: $(aws.service.action.actionType) - $(aws.title)

AWS GuardDuty: $(aws.service.action.actionType) - $(aws.title)
sagan medium other

[DYNAMIC] AWS GuardDuty logs detected via program

[DYNAMIC] AWS GuardDuty logs detected via program
sagan critical other

[AWS-GUARDDUTY] GuardDuty event detected (Backdoor:EC2/Spambot)

[AWS-GUARDDUTY] GuardDuty event detected (Backdoor:EC2/Spambot)
sagan critical other

[AWS-GUARDDUTY] GuardDuty event detected (Behavior:EC2/NetworkPortUnusual)

[AWS-GUARDDUTY] GuardDuty event detected (Behavior:EC2/NetworkPortUnusual)
sagan critical other

[AWS-GUARDDUTY] GuardDuty event detected (Behavior:EC2/TrafficVolumeUnusual)

[AWS-GUARDDUTY] GuardDuty event detected (Behavior:EC2/TrafficVolumeUnusual)
sagan critical other

[AWS-GUARDDUTY] GuardDuty event detected (CredentialAccess:IAMUser/AnomalousBehavior)

[AWS-GUARDDUTY] GuardDuty event detected (CredentialAccess:IAMUser/AnomalousBehavior)
sagan critical other

[AWS-GUARDDUTY] GuardDuty event detected (CredentialAccess:Kubernetes/MaliciousIPCaller)

[AWS-GUARDDUTY] GuardDuty event detected (CredentialAccess:Kubernetes/MaliciousIPCaller)
sagan critical other

[AWS-GUARDDUTY] GuardDuty event detected (CredentialAccess:Kubernetes/SuccessfulAnonymousAccess)

[AWS-GUARDDUTY] GuardDuty event detected (CredentialAccess:Kubernetes/SuccessfulAnonymousAccess)
sagan critical other

[AWS-GUARDDUTY] GuardDuty event detected (CredentialAccess:Kubernetes/TorIPCaller)

[AWS-GUARDDUTY] GuardDuty event detected (CredentialAccess:Kubernetes/TorIPCaller)
sagan critical other

[AWS-GUARDDUTY] GuardDuty event detected (DefenseEvasion:IAMUser/AnomalousBehavior)

[AWS-GUARDDUTY] GuardDuty event detected (DefenseEvasion:IAMUser/AnomalousBehavior)
sagan critical other

[AWS-GUARDDUTY] GuardDuty event detected (DefenseEvasion:Kubernetes/MaliciousIPCaller)

[AWS-GUARDDUTY] GuardDuty event detected (DefenseEvasion:Kubernetes/MaliciousIPCaller)
sagan critical other

[AWS-GUARDDUTY] GuardDuty event detected (DefenseEvasion:Kubernetes/SuccessfulAnonymousAccess)

[AWS-GUARDDUTY] GuardDuty event detected (DefenseEvasion:Kubernetes/SuccessfulAnonymousAccess)
sagan critical other

[AWS-GUARDDUTY] GuardDuty event detected (DefenseEvasion:Kubernetes/TorIPCaller)

[AWS-GUARDDUTY] GuardDuty event detected (DefenseEvasion:Kubernetes/TorIPCaller)
sagan critical other

[AWS-GUARDDUTY] GuardDuty event detected (Discovery:IAMUser/AnomalousBehavior)

[AWS-GUARDDUTY] GuardDuty event detected (Discovery:IAMUser/AnomalousBehavior)
sagan critical other

[AWS-GUARDDUTY] GuardDuty event detected (Discovery:Kubernetes/MaliciousIPCaller)

[AWS-GUARDDUTY] GuardDuty event detected (Discovery:Kubernetes/MaliciousIPCaller)
sagan critical other

[AWS-GUARDDUTY] GuardDuty event detected (Discovery:Kubernetes/SuccessfulAnonymousAccess)

[AWS-GUARDDUTY] GuardDuty event detected (Discovery:Kubernetes/SuccessfulAnonymousAccess)
sagan critical other

[AWS-GUARDDUTY] GuardDuty event detected (Discovery:Kubernetes/TorIPCaller)

[AWS-GUARDDUTY] GuardDuty event detected (Discovery:Kubernetes/TorIPCaller)
sagan critical other

[AWS-GUARDDUTY] GuardDuty event detected (Discovery:S3/AnomalousBehavior)

[AWS-GUARDDUTY] GuardDuty event detected (Discovery:S3/AnomalousBehavior)
sagan critical other

[AWS-GUARDDUTY] GuardDuty event detected (Discovery:S3/MaliciousIPCaller)

[AWS-GUARDDUTY] GuardDuty event detected (Discovery:S3/MaliciousIPCaller)
sagan critical other

[AWS-GUARDDUTY] GuardDuty event detected (Discovery:S3/TorIPCaller)

[AWS-GUARDDUTY] GuardDuty event detected (Discovery:S3/TorIPCaller)
sagan critical other

[AWS-GUARDDUTY] GuardDuty event detected (Execution:Container/MaliciousFile)

[AWS-GUARDDUTY] GuardDuty event detected (Execution:Container/MaliciousFile)