Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
361 detections
Filters
Last updated
All Time
Detection languages
155
66
39
27
23
Contributors
84
65
37
29
27
Categories
20,453
11,837
5,876
5,154
4,865
Platforms
188
168
165
59
24
Products / Services
141
115
50
36
28
MITRE Techniques
153
125
114
85
63
CVEs
6
5
5
5
5
IDS Classtypes
9
8
3
2
1
IDS Protocols
21
1
1
This rule detects attempts to deploy a malicious pod via the Kubernetes API. It specifically looks for HTTP POST requests to the '/api/v1/namespaces/' endpoint followed by '/pods', indicating an attempt to create a new pod within a Kubernetes namespace.
Detects deployment of privileged Docker containers that may allow container escape
This rule detects processes making a high number of successful network connections (10 or more within an hour) to known public container registries such as docker.io or quay.io. This activity could indicate legitimate containerization operations, but also potential malicious activity like downloading malicious container images as part of a supply chain attack, or ingress of tools.
This rule detects attempts to submit a Dockerfile containing 'FROM' and 'RUN' instructions to the Docker API via an HTTP POST request to the '/build' endpoint. This activity could indicate an attacker attempting to build a malicious Docker image on a compromised Docker host.
Detects the creation or deletion of Kubernetes namespaces and nodes via the API server. This activity can indicate an adversary attempting to establish persistence, expand their control, or disrupt the environment within a Kubernetes cluster.
This rule detects processes making a high number of successful network connections (10 or more within an hour) to known public container registries such as docker.io or quay.io. This activity could indicate legitimate containerization operations, but also potential malicious activity like downloading malicious container images as part of a supply chain attack, or ingress of tools.
This rule detects attempts to pull a Docker image via an unauthenticated Docker API. Specifically, it looks for HTTP requests to the '/images/create' endpoint on port 2375, which is the default unauthenticated Docker API port. This activity could indicate an attacker exploiting an exposed Docker daemon to deploy malicious images or gain further access to the host system.
This rule detects attempts to spawn a shell inside a container via the Docker API. Specifically, it looks for HTTP traffic directed to port 2375 (commonly used for the Docker API) containing the string "/bin/sh" in the client body, indicating a command to execute a shell.
Detects kubectl exec and port-forward operations via the Kubernetes API server. 'Exec' provides interactive shell access to a running container, while 'Port-forward' tunnels into the pod network, potentially bypassing network policies. This rule also detects 'attach' operations.
Detects the creation of Kubernetes pods with dangerous security settings that could lead to privilege escalation or container escape. This includes configurations such as enabling hostNetwork, allowing privilege escalation within containers, or running containers as the root user (UID 0).
This rule detects HTTP requests to a Docker daemon's API endpoint (port 2375) specifically targeting the '/networks' URI. This indicates an attempt to enumerate Docker network resources, which could be part of a reconnaissance phase by an attacker to understand the containerized environment.
This rule detects the deployment of a new privileged container via the Docker API. It specifically looks for HTTP requests to the '/containers/create' endpoint with 'Privileged' in the client body, indicating an attempt to create a container with elevated privileges. This activity can be indicative of an attacker attempting to gain higher access or persistence within a compromised system by deploying a malicious container.
This rule detects when a 'docker exec' command is run against a running container. It specifically looks for HTTP POST requests to the '/exec' endpoint, which is used by the Docker API to create and start an exec instance inside a container. This activity could indicate an attacker gaining interactive access to a compromised container.
This rule detects attempts to create a new container service via the Docker API. It specifically looks for HTTP POST requests to the '/services/create' URI on port 2375, which is the default unencrypted Docker API port. This activity could indicate an attacker attempting to establish persistence or execute malicious containers on a compromised Docker host.
This rule detects multiple attempts to pull container image manifests from public Docker registries (registry.hub.docker.com or ghcr.io). A threshold of 10 pulls within 60 seconds from the same source IP is set to identify potentially malicious or excessive activity, possibly indicating an attempt to enumerate or download numerous container images.
This rule detects attempts to deploy a container with host network mode enabled. It specifically looks for HTTP requests to the '/containers/create' endpoint, which is commonly used by container orchestration systems like Docker, and checks for the presence of 'host' within the HTTP client body, indicating the host network mode configuration. This can be a security concern as it allows the container to have direct access to the host's network interfaces, potentially bypassing network segmentation and security controls.
Detects the creation or modification of Kubernetes ClusterRoles, ClusterRoleBindings, and RoleBindings, which can be used for privilege escalation within a Kubernetes cluster. The rule specifically flags activities related to 'cluster-admin' roles as critical and other administrative roles as high severity.
This rule detects attempts to build a Docker image on a compromised host via the Docker API. It specifically looks for HTTP POST requests to the '/build' endpoint on port 2375, which is the default unsecured Docker API port. This activity could indicate an attacker leveraging a compromised system to build malicious Docker images.
This rule detects HTTP requests to the Docker API endpoint '/containers/*/json' which could indicate an attempt to query container environment secrets. The rule specifically looks for requests to the '/containers/' path followed by '/json' in the HTTP URI.
This rule detects attempts to push potentially malicious container images to an internal registry. It specifically looks for HTTP POST requests to '/v2/' and '/blobs/uploads/' URIs, indicating an image layer upload, with a data size greater than 100KB. This behavior could be indicative of an attacker attempting to establish persistence or introduce malicious code into the container environment.
Detects activity where one K8s client accesses many secrets in a short span.
This could be indicative of Credential access, working towards Privilege Escalation.
This could be indicative of Credential access, working towards Privilege Escalation.
Page 13 of 18