Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
24 detections
Filters
Last updated
All Time
Detection languages
8
6
4
3
3
Contributors
21
3
Categories
21
19
6
5
5
Platforms
19
16
16
5
Products / Services
12
5
4
3
3
MITRE Techniques
20
9
8
8
6
CVEs
71
71
64
58
49
21
Detects the Amazon Q VS Code extension or associated language server spawning shell interpreters with suspicious command-line arguments, such as -c flags, network utility commands (curl, wget), or AWS STS credential retrieval commands, potentially indicating exploitation of CVE-2026-12957 (MCP auto-execution abuse).
Detects instances where VS Code extension-related processes (such as amazonq-lsp or extensionHost) spawn shell processes (bash/sh) that subsequently initiate network activity via curl or wget. This pattern is indicative of potential exploitation where malicious workspace configuration files (e.g., .amazonq/mcp.json) are used to execute shell commands with unauthorized access to cloud credentials.
Detects the spawning of shells (bash, sh) or utility processes (npx) as child processes of Amazon Q or VS Code extension host components. This activity is indicative of exploitation attempts involving malicious Model Context Protocol (MCP) server configurations within workspace environments, as identified by CVE-2026-12957.
Page 2 of 2