🧰 Datadog Cloud SIEM

The items that name it 6

• Node2Shell: Reproducing CVE-2026-111497 in the Node.js Brotli decoder
  writeup2026-10-29

  Two detections for command execution tied to Node2Shell: Shell spawned by web server (process activity events with parent process) and Shell spawned by web process (Linux auditd logs).

• PHP2Shell - Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619): detection, analysis, and remediation
  writeup2026-10-21

  Two new detections: Shell spawned by web server or PHP process (process activity events with parent process information) and Shell spawned by web process (Linux auditd logs)

• Beyond valid credentials: How exposed AWS keys are tested for Amazon Bedrock access
  writeup2026-10-06

  Provides out-of-the-box security rules for detecting suspicious Amazon Bedrock activity.

• Attacker infrastructure, but vibe-coded: tracking the evolution of credential harvesting platforms
  writeup2026-09-18

  Out-of-the-box security rules for stolen AWS credentials and Amazon Bedrock abuse

• Threat Hunter's Guide to GitHub (Datadog Security Labs)
  writeup2026-09-16

  ingest GitHub audit log data via Datadog's GitHub integration and build detections tailored to the environment; comes with out-of-the-box detection rules for malicious GitHub activity

• Password spraying campaign targets AWS root user accounts across 150+ organizations
  article2026-08-31

  Out-of-the-box security rules for suspicious AWS root activity