Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
361 detections
Filters
Last updated
All Time
Detection languages
155
66
39
27
23
Contributors
84
65
37
29
27
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
188
168
165
59
24
Products / Services
141
115
50
36
28
MITRE Techniques
153
125
114
85
63
CVEs
6
5
5
5
5
IDS Classtypes
9
8
3
2
1
IDS Protocols
21
1
1
Detects the execution of container-related binaries (act_runner, docker, dockerd) using sensitive command-line flags that indicate potential container escape or high-privilege configuration, such as mounting the host namespace, running in privileged mode, or leaking CI/CD tokens.
Detects Gitea Act Runner spawning Docker containers with high-risk security options (e.g., --privileged, --pid=host, --ipc=host, --cap-add=ALL, or security profile unconfined). These flags are often used to attempt a container escape, allowing a process running within a Gitea CI/CD workflow to gain unauthorized access to the underlying host or other container resources.
Detects anomalous process execution and filesystem access patterns originating from Gitea Act Runner that indicate an attempted container-to-host escape. This includes the injection of dangerous container flags (e.g., --pid=host, --privileged, --cap-add=ALL) into workflow commands, the execution of nsenter, or direct access to the host's filesystem structures (e.g., /host or /proc/1/root).
Detects the Gitea Act Runner CI/CD tool executing Docker containers with dangerous security flags (such as --privileged, --pid=host, or --cap-add=ALL) or spawning nsenter to interact with host namespaces. This behavior indicates a potential attempt to escape the container boundary and gain unauthorized root-level access on the underlying CI/CD runner host.
Detects anomalous process execution patterns associated with the Gitea Act Runner that indicate attempts to break out of container isolation. This includes the use of sensitive Docker flags like --privileged, --pid=host, or --ipc=host, the mounting of the Docker daemon socket, or the execution of nsenter to gain access to the host namespace, which are indicative of container escape techniques.
This rule detects suspicious activity involving container runtimes (e.g., Docker) that indicates potential container escape attempts or unauthorized host interaction. It flags scenarios where container processes spawn administrative shells (cmd.exe, powershell.exe) with SYSTEM privileges, instances of privileged container creation, or direct access to physical drives from container management tools, which are common indicators of host filesystem manipulation.
This rule detects suspicious activity involving container runtimes (e.g., Docker) that indicates potential container escape attempts or unauthorized host interaction. It flags scenarios where container processes spawn administrative shells (cmd.exe, powershell.exe) with SYSTEM privileges, instances of privileged container creation, or direct access to physical drives from container management tools, which are common indicators of host filesystem manipulation.
Detects the creation of Kubernetes pods with dangerous security settings that could lead to container escape or privilege escalation. This includes configurations such as hostNetwork enabled, allowPrivilegeEscalation set to true, or running as root (runAsUser = 0). The rule specifically monitors 'io.k8s.core.v1.pods.create' operations in cloud audit logs.
Detects attempts to perform a container escape via the docker cp command by abusing path traversal vulnerabilities or suspicious file write operations performed by the Docker daemon to the host filesystem outside of standard container paths, often associated with symbolic link extraction exploits.
This rule detects potential container escape attempts utilizing Linux system calls such as 'unshare' or 'clone' with flags indicative of namespace manipulation (CLONE_NEWUSER, CLONE_NEWNET). It also detects the execution of suspected malicious binaries or traffic manipulation tools associated with 'packet_edit_meme' or 'act_pedit' activities, which are common in Linux-based exploitation scenarios.
This rule detects the creation of user namespaces on Linux systems by unprivileged users. The 'unshare' command with '--user' or '-U' flags allows a process to move into a new user namespace, which can be abused for privilege escalation or container escape. The rule specifically excludes common container runtimes and processes running as 'root' to reduce false positives.
This rule detects potential container escape attempts on Linux systems by monitoring suspicious file system access patterns to the host's root directory or process creation events involving 'mount', 'nsenter', or 'chroot' commands with parameters indicative of host interaction. Specifically, it looks for file operations on '/proc/1/root', '/proc/1/cwd', '/proc/1/exe', '/proc/1/fd', '/proc/1/ns', '/proc/1/environ', '/proc/1/mounts' or paths starting with '/host', '/hostroot', '/host-root', '/node-root'. It also flags 'mount' commands targeting '/proc/1/root', '/proc/1', 'nsenter', '--target 1', 'hostpath', or '/host', 'nsenter' commands with namespace manipulation arguments, and 'chroot' commands targeting '/proc/1/root', '/host', or '/hostroot'. These activities are commonly associated with adversaries trying to break out of a containerized environment to gain access to the underlying host.
Detects the command line sequence used by Miasma to restore passwordless sudo for the 'runner' user in GitHub Actions by overwriting sudoers via a Docker container. This specific pattern targets the Miasma Alpine container payload.
Detects pulling of potentially malicious container images from registries
Detects the command line sequence used by Miasma to restore passwordless sudo for the 'runner' user in GitHub Actions by overwriting sudoers via a Docker container. This specific sequence involves echoing 'runner ALL=(ALL) NOPASSWD:ALL' into a file within the /mnt/runner directory and then changing its permissions to 0440, indicative of a privileged modification to the sudoers file within a containerized GitHub Actions runner environment.
Detects shell execution inside Docker containers
Detects Kubernetes CronJob creation for scheduled malicious execution
Detects pulling of potentially malicious container images from registries
Detects enumeration of Docker containers and images
Detects creation of malicious container services via Docker API for persistence
Detects attempts to list, read, create, update, or delete Kubernetes secrets via the Kubernetes API server. This activity could indicate an adversary attempting to gain access to sensitive information or manipulate the environment.
Page 12 of 18