Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
2
Contributors
1
1
Categories
1
1
1
1
1
Platforms
1
1
1
1
1
Products / Services
1
1
1
1
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
This rule detects potentially malicious activity where an identity performs enumeration of Kubernetes secrets or configmaps and subsequently performs a search action within Slack from the same IP address within a one-hour window. This behavioral pattern is indicative of post-breakout reconnaissance, where a compromised identity or token is used to exfiltrate sensitive cloud configuration data and then perform internal reconnaissance in SaaS collaboration tools to identify further targets or credentials.
Detects the use of container inspection tools such as 'dive' or 'docker inspect' to scan image layers or environment variables, specifically targeting the potential exfiltration of credentials or configuration secrets from container images or runtime environments.
