Browse Rules

AWS ELB SSL Policies

Ensures that deprecated TLS versions are not supported in internet-facing load balancers

AWS Enforces SSL Policies

This policy validates that ELBV2 load balancer listeners are using an SSL policy.

AWS Application Load Balancer Web ACL

This policy validates that all application load balancers have an associated Web ACl to enforce protections against various web attacks.

AWS Network ACL Restricts Inbound Traffic

This policy validates that Network ACLs restrict inbound traffic in some way.

AWS Security Group Restricts Inbound Traffic

This policy validates that Security Groups have some restrictions on inbound traffic.

Upwind Vulnerability Detection Passthrough

Re-raises Upwind vulnerability detections in Panther. Covers exploitable CVEs identified in runtime containers, VMs, and serverless environments, prioritized by active exposure.

AWS WAF Has XSS Predicate

This policy validates that all WAF's have at least one rule with a predicate matching on and blocking XSS attacks.

AWS Security Group Restricts Access To CDE

This policy validates that are considered part of the PCI CDE do not allow any access from public IP space.

AWS WAF Managed Known Bad Inputs Passthrough Rule

Detects AWS WAF Known Bad Inputs managed rule group matches. Covers Log4Shell (CVE-2021-44228), Java deserialization RCE, localhost Host header abuse, PROPFIND method, and exploitable paths.

AWS Security Group - Only DMZ Publicly Accessible

This policy validates that only Security Groups designated as DMZs allow inbound traffic from public IP space. This helps ensure no traffic is bypassing the DMZ.

AWS WAF Managed Admin Protection Passthrough Rule

Detects AWS WAF Admin Protection managed rule group matches. Blocks external access to exposed administrative pages such as /admin, /wp-admin, and similar paths.

Upwind API Detection Passthrough

Re-raises Upwind API security detections in Panther. Covers broken authentication, authorization flaws, injection, mass assignment, token misuse, and sensitive data exposure patterns detected at the API layer.

EKS Anonymous API Access Detected

This rule detects anonymous API requests made to the Kubernetes API server. In production environments, anonymous access should be disabled to prevent unauthorized access to the API server.

AWS Security Group Administrative Ingress

This policy validates that AWS Security Groups don't allow unrestricted inbound traffic on port 3389 or 22, ports commonly used for the remote access protocols RDP and SSH respectively.

AWS Security Group Tightly Restricts Inbound Traffic

This policy validates that Security Groups have restrictive permission sets that both limit the total number of open ports, as well as limiting ports typically associated with insecure protocols.

AWS WAF Managed Core Rule Set Passthrough Rule

Detects AWS WAF Core Rule Set (CRS) managed rule group matches. Covers XSS, LFI, RFI, SSRF, size restrictions, restricted extensions, and bad bot user agents across all WAF sources.

AWS WAF Managed SQL Database Passthrough Rule

Detects AWS WAF SQL Database managed rule group matches. Covers SQL injection patterns in query arguments, request body, cookies, and URI path, including extended patterns not covered by the Core Rule Set.

AWS WAF ReactJS RCE Attempt via Body

Detects AWS WAF ReactJSRCE_BODY managed rule matches indicating React2Shell (CVE-2025-55182) ReactJS RCE attempts via HTTP body. Monitors all WAF sources: ALB, CloudFront, API Gateway, AppSync.

AWS WAF Managed IP Reputation Passthrough Rule

Detects AWS WAF IP Reputation and Anonymous IP List managed rule group matches. Flags requests from IPs on Amazon threat intelligence lists including known bots, reconnaissance sources, DDoS participants, TOR nodes, temporary proxies, and hosting/cloud provider IPs.

EKS Audit Log Reporting system Namespace is Used From A Public IP

This detection identifies if an activity is recorded in the Kubernetes audit log where the user:username attribute begins with "system:" or "eks:" and the requests originating IP Address is a Public IP Address

Kubernetes NodePort Service Deployed

This detection monitors for any Kubernetes service deployed with type NodePort. A NodePort service allows an attacker to expose a set of pods hosting the service to the internet by opening their port and redirecting traffic here. This can be used to bypass network controls and intercept traffic, creating a direct line to the outside network.

Exploit Public Facing Application via Apache Commons Text

The following analytic detects attempts to exploit the CVE-2022-42889 vulnerability in the Apache Commons Text Library, known as Text4Shell. It leverages the Web datamodel to identify suspicious HTTP requests containing specific lookup keys (url, dns, script) that can lead to Remote Code Execution (RCE). This activity is significant as it targets a critical vulnerability that can allow attackers to execute arbitrary code on the server. If confirmed malicious, this could lead to full system compr

GCP K8S Service Type NodePort Deployed

This detection monitors for any kubernetes service deployed with type node port. A Node Port service allows an attacker to expose a set of pods hosting the service to the internet by opening their port and redirecting traffic here. This can be used to bypass network controls and intercept traffic, creating a direct line to the outside network.