Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
72 detections
Filters
Last updated
All Time
Detection languages
41
21
4
4
1
Contributors
40
21
5
4
1
Categories
34
15
8
8
7
Platforms
54
7
7
2
2
Products / Services
10,660
9,755
6,689
4,418
3,748
MITRE Techniques
28
17
16
11
10
CVEs
1
1
1
Amazon GuardDuty detects an Amazon EC2 instance or a container querying algorithmically generated domains (DGA).
Amazon GuardDuty detects a malicious or suspicious file on an Amazon EC2 instance or a container workload.
Amazon GuardDuty detects an Amazon EC2 instance or a container attempting to communicate with a black hole IP address.
Amazon GuardDuty detects a brute force activity in an Amazon EC2 or Amazon RDS instance.
Amazon GuardDuty detects Command and control activity in Amazon EC2, AWS Lambda or Amazon EKS Runtimes.
Amazon GuardDuty detects CryptoCurrency activity in Amazon EC2, AWS Lambda or Amazon EKS Runtimes.
Amazon GuardDuty detects a Denial of Service (DoS) activity in an Amazon EC2 instance.
Amazon GuardDuty detects Tor Network activity in an AWS account.
Detects when an IP set is created in AWS GuardDuty. This activity could indicate an adversary attempting to whitelist their malicious IP addresses to avoid detection by GuardDuty, thereby disabling security alerts against their activities.
Page 4 of 4