Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
361 detections
Filters
Last updated
All Time
Detection languages
155
66
39
27
23
Contributors
84
65
37
29
27
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
188
168
165
59
24
Products / Services
141
115
50
36
28
MITRE Techniques
153
125
114
85
63
CVEs
6
5
5
5
5
IDS Classtypes
9
8
3
2
1
IDS Protocols
21
1
1
Detects execution of the 'docker cp' command containing directory traversal sequences ('../', '..") in the command line arguments. This pattern is indicative of attempts to exploit path traversal vulnerabilities to read or write files outside the intended container scope, potentially leading to container escape.
This rule detects the execution of container runners (act-runner/gitea-act-runner) with insecure container isolation flags, such as mounting the host root filesystem, disabling security profiles (seccomp/apparmor), or running with host namespaces and excessive capabilities. These configurations indicate potential container escape attempts or misconfigurations that allow significant host-level access.
This rule detects potential Mythic C2 implant or payload build activity occurring via Docker. It monitors for executions of docker.exe, docker-compose.exe, or docker commands initiated by shells (cmd.exe, powershell.exe) containing keywords associated with the Mythic C2 framework, while explicitly excluding common CI/CD runner parent processes to reduce noise.
This rule detects potentially malicious activity within Linux environments or containers where a single user context concurrently performs credential hunting (via environment variable dumping or accessing .env files) and terminates processes associated with known cryptocurrency miners or competing malicious actors. This behavior is highly indicative of a cryptojacking infection or a malicious actor clearing out existing resource-hijacking threats.
Detects the creation of Kubernetes pods where the 'hostPID' or 'hostNetwork' settings are enabled. These configurations allow a pod to share the host's process namespace or network stack, respectively, which are common vectors for container escapes and host-level privilege escalation.
Detects the creation of Kubernetes pods where the 'hostPID' or 'hostNetwork' settings are enabled. These configurations allow a pod to share the host's process namespace or network stack, respectively, which are common vectors for container escapes and host-level privilege escalation.
Detects a suspicious sequence of events where a Gitea act_runner process spawns a container with dangerous namespace or capability flags (e.g., --pid=host, --cap-add=ALL) followed by the execution of 'nsenter' in the same environment, indicating an attempt to escape the container to the host.
Detects the use of the 'cp' command within a Docker container context to access files outside the current working directory, identified by the usage of parent directory traversal (..). This pattern is often associated with container escape attempts or unauthorized file access within a containerized environment.
Detects the execution of Gitea/Act runner or Docker containers with dangerous configurations that allow host-level access, such as privileged mode, host PID/IPC namespaces, or disabled security profiles (AppArmor/Seccomp). These configurations are often used to escape container isolation or execute commands on the underlying host.
Detects attempts to perform a container escape using path traversal via the 'docker cp' command. This rule monitors for malicious directory traversal sequences, the creation of specific artifacts used in known PoC exploits for container escapes, and the subsequent execution of scripts or shell interpreters by container management processes.
This rule detects activities indicative of a Docker container escape, specifically targeting the 'docker cp' path traversal vulnerability. It monitors for suspicious command-line patterns involving path traversal sequences ('../'), execution of shells or common utilities from container-related processes (dockerd, containerd, etc.), and the presence of known proof-of-concept artifacts or files written outside the expected container boundary.
Detects potentially malicious container escape or privilege escalation attempts initiated by Gitea act runner processes. This includes the spawning of 'nsenter', the use of dangerous Docker flags that provide host-level access (such as host PID/IPC namespaces, all capabilities, or disabled security mechanisms), and the spawning of shells inside containers configured with namespace-entering commands.
Detects potential container escape attempts leveraging path traversal vulnerabilities in the 'docker cp' command (e.g., CVE-2026-55199). The rule identifies file creation events triggered by docker processes where the target file path is outside the expected Docker root or temporary directory structures, suggesting an effort to write files to arbitrary locations on the host filesystem.
This rule detects potential Mythic C2 implant or payload build activity occurring via Docker. It monitors for executions of docker.exe, docker-compose.exe, or docker commands initiated by shells (cmd.exe, powershell.exe) containing keywords associated with the Mythic C2 framework, while explicitly excluding common CI/CD runner parent processes to reduce noise.
This rule detects potential container escape attempts on Linux systems by monitoring suspicious file system access patterns to the host's root directory or process creation events involving 'mount', 'nsenter', or 'chroot' commands with parameters indicative of host interaction. Specifically, it looks for file operations on '/proc/1/root', '/proc/1/cwd', '/proc/1/exe', '/proc/1/fd', '/proc/1/ns', '/proc/1/environ', '/proc/1/mounts' or paths starting with '/host', '/hostroot', '/host-root', '/node-root'. It also flags 'mount' commands targeting '/proc/1/root', '/proc/1', 'nsenter', '--target 1', 'hostpath', or '/host', 'nsenter' commands with namespace manipulation arguments, and 'chroot' commands targeting '/proc/1/root', '/host', or '/hostroot'. These activities are commonly associated with adversaries trying to break out of a containerized environment to gain access to the underlying host.
Detects creation of Kubernetes role bindings for elevated cluster access
Detects the suspicious combination of 'aa-exec' (commonly associated with AppArmor or specific container runtime wrappers) being followed by the execution of 'unshare' with flags used to manipulate kernel namespaces (user, network). This pattern is often indicative of container breakouts or privilege escalation attempts where an adversary leverages namespace isolation to gain higher privileges on the host.
Detects the execution of the 'unshare' utility by non-root users with flags designed to create new user or network namespaces. This behavior is often associated with container escape attempts, privilege escalation, or efforts to bypass local security controls by creating isolated environments.
This rule monitors process execution events for the 'aa-exec' utility, a tool often used in containerized environments (such as AppArmor) or specific runtime configurations, when invoked with specific command-line arguments (-p trinity, -p chrome, or -p flatpak). These patterns are indicative of specialized container or sandbox execution activities that may warrant investigation in specific enterprise environments.
Detects execution of the CVE-2026-46331 exploit chain, which utilizes unprivileged user namespace creation to escalate privileges followed by malicious Linux traffic control (tc) pedit actions to achieve kernel-level page cache corruption.
Detects potential container breakout attempts on Windows systems by monitoring for the launch of privileged containers with sensitive host paths mounted, the execution of host-level processes directly spawned by container runtime binaries (docker.exe, containerd.exe), and direct access to sensitive host filesystems (e.g., C:\windows, C:\etc, C:\programdata) by container runtimes.
Page 10 of 18