Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
278 detections
Filters
Last updated
All Time
Detection languages
202
34
14
11
6
Contributors
86
73
31
29
11
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
257
19
18
13
7
Products / Services
190
63
33
19
19
MITRE Techniques
116
71
56
41
41
CVEs
5
5
5
5
5
This rule detects when Amazon GuardDuty identifies an Amazon EC2 instance or a container querying algorithmically generated domains (DGA). DGA activity is often indicative of malware attempting to establish command and control (C2) communication with its operators. The rule specifically looks for GuardDuty findings with the product event type 'DGADomainRequest' and filters out sample findings.
Amazon GuardDuty detects a malicious or suspicious file on an Amazon EC2 instance or a container workload.
Amazon GuardDuty detects a brute force activity in an Amazon EC2 or Amazon RDS instance.
Detects blocking of process creations originating from PSExec and WMI commands
Detects when a Microsoft Cloud App Security reported a user has deleted a unusual a large volume of files.
Page 14 of 14