Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
361 detections
Filters
Last updated
All Time
Detection languages
155
66
39
27
23
Contributors
84
65
37
29
27
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
188
168
165
59
24
Products / Services
141
115
50
36
28
MITRE Techniques
153
125
114
85
63
CVEs
6
5
5
5
5
IDS Classtypes
9
8
3
2
1
IDS Protocols
21
1
1
This rule monitors container logs for attempts to access the Azure Instance Metadata Service (IMDS) via the 169.254.169.254 endpoint to request OAuth tokens or access Azure Key Vault secrets. Such activity within a containerized environment is often indicative of credential theft or discovery attempts by an adversary attempting to escalate privileges using the container's managed identity.
Detects 'docker login' commands targeting an Azure Container Registry (.azurecr.io) that explicitly include username and password flags in the command line string. This behavior may indicate credential usage for registry authentication.
This rule detects 'Push', 'Put', or 'PutManifest' operations on the 'mongo' repository using specific tags ('mongofr', 'latest'), which may indicate an attempt to overwrite or inject a malicious container image into a critical database registry.
Detects outbound TLS traffic directed toward ngrok.io infrastructure originating from Azure Container Instances. Ngrok is frequently used by adversaries to establish reverse proxies and tunnels to maintain persistent command-and-control access to compromised cloud-hosted containers.
Detects the execution of bindutil.exe with arguments typically used to establish links or silo configurations, excluding known legitimate parent processes associated with container and virtualization services.
Detects the successful creation or update of an Azure Container Instance labeled with 'fortress' that utilizes a MongoDB image from a specific internal container registry.
Detects the use of container inspection tools such as 'dive' or 'docker inspect' to scan image layers or environment variables, specifically targeting the potential exfiltration of credentials or configuration secrets from container images or runtime environments.
Detects the restart action performed on a specific Azure container group named 'fr33m3' within the 'bialystok-rg' resource group. This monitors for lifecycle management activities that could be indicative of service manipulation or persistence resets.
Detects instances where an Azure Container Group is restarted within 30 minutes of a successful container image push to an Azure Container Registry in the same subscription. This pattern may indicate an automated or manual deployment process following a code update, which could be misused if unauthorized image pushes are occurring.
Detects push operations to an Azure Container Registry. This activity is a common administrative task but can also indicate an adversary pushing a malicious, backdoored, or unauthorized container image into an environment, potentially for persistence or supply chain attack purposes.
Detects the creation of Azure Container Registry (ACR) scoped access tokens or scope maps. Adversaries may use these features to establish persistent, least-privileged access to registry resources, often bypassing standard authentication monitoring.
Detects the deployment of an Azure Container Instance (ACI) where the image source or container name matches identified indicators of a potentially compromised registry or unauthorized deployment pattern.
Detects the creation or modification of tokens for an Azure Container Registry (ACR). This activity may indicate an administrator managing registry access, or an adversary creating long-lived credentials for persistence within the container environment.
This rule monitors for successful Azure Container Registry task write, run, or action operations that involve references to identity configurations, Azure KeyVault (vault.azure.net), or ACR task YAML files. These keywords are often associated with the configuration of managed identities or secret retrieval within the build process, which may indicate unauthorized task creation or manipulation to escalate privileges or exfiltrate secrets.
Detects Docker CLI execution attempting to bind mount sensitive host system directories (e.g., Windows, ProgramData) into a container. This technique is often used as a container escape vector to gain unauthorized access to host files and escalate privileges to SYSTEM.
Detects potential discovery of sensitive information (secrets) within container images by monitoring for the usage of 'dive' targeting private Azure Container Registry images or the use of 'docker inspect' to extract 'Config.Env' combined with 'grep' for the term 'secret'. This activity is often associated with reconnaissance for credential harvesting in containerized environments.
Detects Azure CLI operations creating or modifying an Azure Container Registry (ACR) Task with an attached managed identity, where the task definition references Key Vault secrets. This pattern is used to abuse ACR Task automation and its managed identity to exfiltrate Key Vault secrets.
Detects the manual execution of an Azure Container Registry (ACR) task using the 'az acr task run' command. This could indicate an adversary attempting to leverage ACR build capabilities to execute malicious build steps, pull images, or perform unauthorized automation tasks within the container registry environment.
Detects a modified Dockerfile or build script installing netcat and building/pushing a multi-arch image via docker buildx, consistent with backdoored container image creation
Detects the use of 'docker login' commands targeting an Azure Container Registry (.azurecr.io) that include a password passed as a plaintext argument via the '-p' or '--password' flags. This practice exposes credentials in process command-line arguments, which may be visible to other users on the system or logged by security tools.
Detects reconnaissance activities targeting Azure Container Registry, specifically the listing of available repositories using the Azure CLI and pulling container images, which may indicate an adversary attempting to discover or exfiltrate software components.
Page 7 of 18