Detectors

Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.

26 detectors match the current filters. technique: T1537 ✕

Download CSV
Type Name Severity Module Data source / event ATT&CK
Analytics BIOC A Cloud DB instance was exported to an unknown destination A Cloud DB instance was exported to a foreign storage destination. The destination storage has not been seen in the organization in the last 30 days. Informational Cortex Cloud Gcp Audit Log Exfiltration
Analytics BIOC A cloud snapshot of AWS database or storage was modified or shared A cloud identity has shared a snapshot of an AWS database or storage instance. Informational Cortex Cloud AWS Audit Log Exfiltration
Analytics BIOC A GCP Cloud SQL DB instance was exported from a production account A GCP Cloud SQL DB instance was exported to a storage bucket. The DB instance was exported from a production account. Informational Cortex Cloud Gcp Audit Log Exfiltration
Analytics BIOC An AWS EC2 instance containing sensitive data was exported A EC2 instance was exported to an S3 bucket. The instance was found to contain sensitive data. Informational Cortex Cloud AWS Audit Log Exfiltration
Analytics BIOC An AWS EC2 instance was exported from a production account An EC2 instance was exported from a production account to an S3 bucket. Informational Cortex Cloud AWS Audit Log Exfiltration
Analytics BIOC An AWS EC2 instance was exported into an unknown S3 bucket An EC2 instance was exported to an unknown S3 bucket. Informational Cortex Cloud AWS Audit Log Exfiltration
Analytics BIOC An AWS RDS instance was created from a snapshot A new AWS RDS instance was created from a publicly available RDS snapshot. Informational Cortex Cloud AWS Audit Log Exfiltration
Analytics BIOC An Azure SQL database was exported from a production subscription An Azure SQL database export was initiated. The database was exported from a production subscription. Informational Cortex Cloud Azure Audit Log Exfiltration
Analytics BIOC An Azure VM snapshot SAS URL was generated An identity generated a SAS URL for an Azure VM snapshot. SAS URLs allow others to download or export the snapshot. Informational Cortex Cloud Azure Audit Log Exfiltration
Analytics BIOC An Azure VM snapshot SAS URL was generated for export from a production subscription A SAS URL for an Azure VM snapshot was generated. The operation was performed within a production subscription. SAS URLs allow others to download or export the snapshot. Informational Cortex Cloud Azure Audit Log Exfiltration
Analytics An identity initiated a download of multiple cloud objects An identity initiated a download of multiple cloud objects. This might be an indication for an adversary trying to exfiltrate data from cloud storage. Informational Cortex Cloud AWS Audit Log, Azure Audit Log, Gcp Audit Log Collection, Exfiltration
Analytics BIOC An RDS snapshot containing sensitive data was exported An RDS snapshot containing sensitive data was exported to an S3 bucket. Informational Cortex Cloud AWS Audit Log Exfiltration
Analytics BIOC An RDS snapshot was exported from a production account An RDS snapshot was exported from a production account to an S3 bucket. Informational Cortex Cloud AWS Audit Log Exfiltration
Analytics BIOC An RDS snapshot was exported to an unknown bucket An RDS snapshot was exported to an unknown S3 bucket. The destination bucket has not been seen in your tenant in the last 30 days. Informational Cortex Cloud AWS Audit Log Exfiltration
Analytics BIOC An unusual cloud identity was granted permissions to a BigQuery resource An unusual cloud identity was granted permissions to a BigQuery table or dataset. Informational Cortex Cloud Gcp Audit Log Exfiltration, Defense Evasion
Analytics BIOC AWS EC2 instance exported into S3 A running or stopped instance was exported to an Amazon S3 bucket. Informational Cortex Cloud AWS Audit Log Exfiltration
Analytics BIOC AWS Transfer Family server created A cloud identity created server using AWS Transfer Family service. Informational Cortex Cloud AWS Audit Log Exfiltration
Analytics BIOC Azure storage account cross-tenant object replication was enabled Azure cross-tenant object replication in a storage account was enabled. Informational Cortex Cloud Azure Audit Log Exfiltration
Analytics BIOC BigQuery table or query results exfiltrated to a foreign project A cloud identity exfiltrated BigQuery table data to a foreign storage service. Informational Cortex Cloud Gcp Audit Log Exfiltration
Analytics BIOC Bucket's block public access setting turned off S3 bucket block public access setting turned off. Informational Cortex Cloud AWS Audit Log Exfiltration
Analytics BIOC Bucket's object ownership controls were modified S3 bucket object ownership controls were modified. Informational Cortex Cloud AWS Audit Log Exfiltration
Analytics BIOC Cloud snapshot created or modified A cloud identity has created or modified a cloud snapshot. Informational Cortex Cloud AWS Audit Log, Azure Audit Log, Gcp Audit Log Exfiltration, Defense Evasion, Collection
Analytics BIOC EC2 instance Amazon machine image was created Amazon machine image was created from elastic compute cloud instance. Informational Cortex Cloud AWS Audit Log Exfiltration
Analytics BIOC External Sharing was turned on for Google Drive An identity has modified Google Drive sharing settings and allowed external sharing. Informational Identity Threat Detection (ITDR), SaaS Threat Detection Google Workspace Audit Logs Exfiltration
Analytics BIOC Foreign account was granted permissions to S3 bucket via resource-based policy Foreign account was granted access to S3 bucket. Informational Cortex Cloud AWS Audit Log Exfiltration
Analytics Multiple cloud snapshots export A cloud identity has downloaded multiple virtual machines or DB snapshots locally. Informational Cortex Cloud AWS Audit Log, Azure Audit Log, Gcp Audit Log Exfiltration