Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
90 detections
Filters
Last updated
All Time
Detection languages
35
23
11
9
4
Contributors
26
21
20
3
3
Categories
44
39
38
27
17
Platforms
50
44
40
30
19
Products / Services
23
18
16
14
8
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
3
3
3
3
3
IDS Classtypes
9
6
6
2
IDS Protocols
22
Detects Server-Side Request Forgery (SSRF) attempts targeting the Google Cloud Platform (GCP) metadata server (169.254.169.254). The rule inspects RequestURL and RequestContext fields for indicators of metadata API access, URL parameter manipulation, authority confusion payloads, and encoding bypass techniques often used to access cloud instance metadata for unauthorized credential or information harvesting.
Detects HTTP requests attempting to access sensitive internal IP addresses (RFC-1918) or cloud metadata services (e.g., 169.254.169.254) which are common indicators of Server-Side Request Forgery (SSRF) exploitation attempts.
Detects network connections from Node.js or Bun runtime processes to common cloud instance metadata service IPs (AWS, Azure, GCP) or to the default HashiCorp Vault port (8200). This activity can indicate credential access attempts, especially in the context of a supply chain attack where malicious code might be injected into a Node.js/Bun application to exfiltrate sensitive information or gain further access. The rule correlates network connection events with process execution events to identify the specific runtime responsible.
Detects network connection attempts to the cloud Instance Metadata Service (IMDS) endpoint (169.254.169.254) initiated by processes that are not known cloud management agents or system utilities, which may indicate unauthorized credential or IAM role token theft.
Detects processes attempting to query the Cloud Instance Metadata Service (IMDS) endpoint (169.254.169.254) that are not recognized as legitimate cloud agent software (such as AWS, Azure, or Google cloud agents). This behavior is often indicative of SSRF or unauthorized discovery attempts by an adversary on a compromised cloud instance.
Detects processes attempting to query the Cloud Instance Metadata Service (IMDS) endpoint (169.254.169.254) that are not recognized as legitimate cloud agent software (such as AWS, Azure, or Google cloud agents). This behavior is often indicative of SSRF or unauthorized discovery attempts by an adversary on a compromised cloud instance.
This rule monitors Cisco Unified Communications Manager (UCM) environments for multiple stages of an attack chain, including potential Server-Side Request Forgery (SSRF) attempts against administrative interfaces, suspicious file modifications by service accounts, indicators of privilege escalation, and anomalous outbound network connections from core Cisco processes.
Detects instances where common web application processes (such as Flask, Django, Gunicorn) execute system utilities (curl, wget, etc.) to query the cloud metadata service URL (169.254.169.254) or domain names associated with instance metadata. This behavior is indicative of potential SSRF exploitation to retrieve cloud environment secrets or instance identity credentials.
This rule monitors for suspicious activity associated with Flowise Model Context Protocol (MCP) implementations, specifically detecting environment variable bypasses using Node.js --require, potential Server-Side Request Forgery (SSRF) attempts targeting internal infrastructure and cloud metadata services, and the creation of known proof-of-concept (PoC) artifacts.
Detects Node.js attempting to query the AWS/GCP internal metadata IP (169.254.169.254) to extract cloud instance IAM roles. This activity is associated with the Stitch-SDK scope squatting credential harvester.
This rule monitors Cisco Unified Communications Manager (UCM) environments for multiple stages of an attack chain, including potential Server-Side Request Forgery (SSRF) attempts against administrative interfaces, suspicious file modifications by service accounts, indicators of privilege escalation, and anomalous outbound network connections from core Cisco processes.
Detects an AI agent (manipulated by a poisoned recommendation prompt) attempting to access internal Cloud Metadata endpoints (e.g., AWS IMDS, Azure IMDS) to steal underlying infrastructure tokens.
This rule detects Server-Side Request Forgery (SSRF) attempts originating from Cisco WebDialer by identifying network requests targeting loopback addresses (127.0.0.1, localhost, ::1), cloud instance metadata API addresses (169.254.169.254), private IP ranges (10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12), or using 'file://' or 'gopher://' protocols. The rule specifically looks for 'webdialer' in the event_sub_type or action_remote_ip fields to narrow down the source of the request. The XQL view includes actor and causality fields for further investigation.
Detects network connection attempts to the cloud Instance Metadata Service (IMDS) endpoint (169.254.169.254) initiated by processes that are not known cloud management agents or system utilities, which may indicate unauthorized credential or IAM role token theft.
Detects anomalous outbound network connections originating from the Python/vLLM process to irregular ports or cloud metadata IPs. This behavior may indicate command-and-control establishment, secondary staging, or cloud metadata pivoting following a successful CVE-2026-22778 exploit.
Detects Python processes accessing sensitive credential paths, a common post-exploitation step for malicious ML models (e.g., CVE-2026-4372). The rule specifically looks for Python executables accessing paths commonly associated with cloud (AWS) or container (Kubernetes) credentials. It includes exclusions for known legitimate ML pipeline scripts to reduce noise.
This rule detects HTTP requests to the Azure Instance Metadata Service (IMDS) IP address (169.254.169.254) with the URI containing 'metadata/instance'. This activity indicates an attempt to discover information about the Azure virtual machine instance, which can be a legitimate administrative action or an adversary attempting to collect credentials and other sensitive data.
This rule detects HTTP requests attempting to access the AWS EC2 Instance Metadata service, specifically targeting the 'latest/meta-data' endpoint. This service, typically found at the IP address 169.254.169.254, provides information about the running EC2 instance, including credentials and other sensitive data. Unauthorized access to this endpoint can indicate an attacker attempting to gain further access or information within an AWS environment.
Detects Bun or Node.js processes spawned from temporary directories making requests
to cloud instance metadata services (AWS IMDSv2, Azure IMDS). The Miasma worm
harvests cloud credentials from CI runners via these endpoints.
to cloud instance metadata services (AWS IMDSv2, Azure IMDS). The Miasma worm
harvests cloud credentials from CI runners via these endpoints.
Detects Node.js or Bun processes making HTTP requests to AWS IMDS or ECS metadata endpoints,
indicative of credential harvesting by the Mini Shai-Hulud malware.
indicative of credential harvesting by the Mini Shai-Hulud malware.
Detects network connections from Node.js or Bun runtime processes to common cloud instance metadata service IPs (AWS, Azure, GCP) or to the default HashiCorp Vault port (8200). This activity can indicate credential access attempts, especially in the context of a supply chain attack where malicious code might be injected into a Node.js/Bun application to exfiltrate sensitive information or gain further access. The rule correlates network connection events with process execution events to identify the specific runtime responsible.
Page 4 of 5