Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
361 detections
Filters
Last updated
All Time
Detection languages
155
66
39
27
23
Contributors
84
65
37
29
27
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
188
168
165
59
24
Products / Services
141
115
50
36
28
MITRE Techniques
153
125
114
85
63
CVEs
6
5
5
5
5
IDS Classtypes
9
8
3
2
1
IDS Protocols
21
1
1
Detects the execution of an Azure Container Registry (ACR) task utilizing a specifically named 'secret-task.yaml' file, which is often associated with adversary attempts to leverage cloud automation for malicious container deployment or secret exfiltration.
Detects modifications to enable the admin account for an Azure Container Registry (ACR), or queries to check the status of this setting. Enabling the admin account provides a static username/password combination that can be used for authentication, which may represent an security risk or account manipulation if not authorized.
This rule detects potential container escape attempts by monitoring for path traversal attacks via 'docker cp', the execution of shells within privileged or volume-mounted containers, and unexpected file operations occurring outside the container root filesystem.
Detects build process content (likely within a Dockerfile or CI/CD script) that installs 'netcat' and initiates a multi-architecture build and push operation to a specific container registry path (registryfr.azurecr.io/mongo:latest), which may indicate the creation of a backdoored or malicious container image.
Detects execution of processes using 'LOAD_FILE' (often associated with MySQL or specific command-line utilities) to attempt to read sensitive container-related paths such as '/var/run/docker.sock' or '/proc/1/cgroup'. This behavior is indicative of an attacker attempting to gather information for container escape or environment reconnaissance.
Detects the restart of an Azure Container Instance via the Microsoft.ContainerInstance/containerGroups/restart/action operation. This could indicate an attempt to disrupt service availability or potentially hide malicious modifications made to a container by forcing a state change.
Detects the usage of the 'docker cp' command containing directory traversal sequences ('../') in the destination argument. This behavior is associated with a known container escape technique where an attacker can overwrite files on the host filesystem by escaping the container's designated storage path.
Detects the use of 'docker cp' commands containing path traversal sequences (e.g., '../') in the destination path. This pattern is indicative of an attempt to escape the container filesystem boundary and write arbitrary files to the host system by exploiting vulnerabilities in the docker cp utility.
This rule detects potentially malicious MySQL database operations involving sensitive file access or suspicious data exportation. It monitors for the use of 'INTO OUTFILE' commands pointing to sensitive paths (like /var/lib/mysql-files/) or the use of 'LOAD_FILE' commands to access system files such as /var/run/docker.sock, /proc/1/cgroup, or /proc/1/mountinfo, which are indicative of attempts to exfiltrate database content or escape a container environment.
Detects instances where the Argo CD repo-server or kustomize processes spawn unexpected child processes, such as shells or network utilities. This behavior is indicative of potential command injection, specifically concerning the unauthenticated GenerateManifest gRPC service vulnerability (CVE-2024-31989), where an attacker could execute arbitrary code on the underlying host or container.
Detects the execution of 'kustomize' with the '--helm-command' flag configured to use a non-standard binary or script. When triggered within the context of an Argo CD repo-server, this behavior indicates a potential exploitation attempt of CVE-2024-31989, which allows for arbitrary command execution under the repo-server process context by coercing Kustomize to execute malicious files.
This rule detects a correlation between an unauthorized IAM user access event and the subsequent execution of cryptocurrency mining tools within the same AWS account within a one-hour window. This is a strong indicator of an adversary leveraging compromised cloud credentials to perform resource hijacking.
Detects suspicious process execution by GitHub Runner.Worker or Runner.Listener on CI runners. It specifically targets the execution of scripts or binaries associated with compromised action components (such as trivy-action or setup-trivy) where version tags have been tampered with to inject credential-harvesting code. The rule monitors for unauthorized command line arguments or file paths linked to these components.
Detects unauthorized attempts to access or extract Redis credentials from the Argo CD repo-server process. The detection identifies suspicious command-line activity where environment variables are enumerated (via env or printenv) or sensitive configuration files (/etc/argocd) are accessed by the repo-server process or its children. This behavior is indicative of an attacker attempting to exploit unauthenticated gRPC vulnerabilities to steal credentials for cache poisoning or further lateral movement within a containerized environment.
Detects attempts to perform container escapes or escalate privileges within a Gitea Actions runner environment. The rule monitors for the execution of dangerous container options (e.g., --pid=host, --privileged, --cap-add=ALL) in CI/CD workflow configurations, the spawning of 'nsenter' by the runner process, and writes to sensitive host system paths from containerized processes.
Detects unauthenticated HTTP requests to sensitive Gitea endpoints containing the 'X-WEBAUTH-USER' header set to 'admin'. This rule identifies exploitation attempts against misconfigured Docker deployments where 'REVERSE_PROXY_TRUSTED_PROXIES' is improperly set to a wildcard, allowing unauthorized users to impersonate administrative accounts (CVE-2026-20896).
Detects the deployment of container images in AWS ECS or EC2 via RunInstances or RegisterTaskDefinition from registries other than Amazon Elastic Container Registry (ECR) or public ECR. This rule identifies potentially unauthorized or untrusted container sources, which could indicate an adversary attempting to deploy malicious images for persistence or exploitation.
Detects the use of the 'docker cp' command with suspicious path traversal characters or known PoC artifacts in the destination parameter. This behavior is indicative of an attempt to exploit path traversal vulnerabilities in the Docker daemon (such as those allowing container escape) by writing files outside the container's intended scope onto the host filesystem.
Detects anomalous process execution chains originating from Gitea or Gitea Act Runner processes. This rule is designed to catch post-exploitation behavior associated with CVE-2026-20896, where an improperly configured reverse proxy allows an attacker to impersonate an administrator. The detection identifies shells, scripting interpreters, and network utilities spawned by the Gitea service, which may indicate command injection, malicious git hook execution, or CI/CD job abuse following an unauthorized administrative access.
Detects Gitea act_runner spawning Docker containers with dangerous runtime flags (e.g., --pid=host, --privileged, --cap-add=ALL) that facilitate host namespace escape. This activity is indicative of exploitation of CVE-2026-20896, where malicious CI/CD workflow YAML files inject these options to break out of the container sandbox and access the host filesystem.
This rule detects potential container escape attempts by monitoring for malicious use of the 'docker cp' command with path traversal sequences (../) or the creation of suspicious files by the docker daemon outside of expected docker storage directories, which may indicate symlink injection attacks to modify files on the host filesystem.
Page 8 of 18