Browse Rules

AWS VPC Default Security Group Restrictions

This policy validates that the default Security Group for a given AWS VPC is restricting all inbound and outbound traffic.

AWS VPC Default Network ACL Restricts All Traffic

This policy validates that the default Network ACL for a given AWS VPC is restricting all inbound and outbound traffic.

AWS RDS Instance Modified to be Publicly Accessible

Detects when an RDS instance or cluster is modified to become publicly accessible. This exposes the database to the internet and is used by attackers for persistence or data exfiltration. This detects the modification event in real-time, unlike static policy checks.

AKS Kubelet nodes/proxy Command Execution from an External Source IP

This hunt surfaces command execution against a node's Kubelet through the AKS (Azure Kubernetes Service) API server nodes/proxy subresource where the request originates from an external (non-internal) client IP. A principal holding nodes/proxy can tunnel through the API server to a node's Kubelet and run commands in any pod on that node (kubeletctl, Peirates), and even a GET to the /exec endpoint is remote code execution because the Kubelet maps the WebSocket upgrade handshake to the RBAC get ve

Azure Excessive IP and VM Discovery

Detects excessive read operations on Azure public IP addresses and virtual machines. Adversaries may enumerate public IPs and virtual machines to identify external attack surfaces, map network topology, and identify potential targets for exploitation. This reconnaissance pattern often precedes lateral movement attempts, privilege escalation, or targeted attacks. The threshold-based detection triggers when the same resource type is read excessively within a time window.