Detects suspicious shell commands used in various Equation Group scripts and tools

Detects suspicious command sequence that JexBoss

Detects suspicious shell commands used in various exploit codes (see references)

Detects relevant commands often related to malware or hacking activity

Detects suspicious shell commands or program code that may be executed or used in command line to establish a reverse shell

Detects the usage of the unsafe bpftrace option

Detects changes to the EC2 instance startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up.