Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
57 detections
Filters
Last updated
All Time
Detection languages
24
10
6
5
5
Contributors
13
9
6
5
5
Categories
44
28
14
13
6
Platforms
29
25
24
6
3
Products / Services
25
22
13
6
6
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
1
IDS Classtypes
4
2
IDS Protocols
6
Detects the execution of the 'aa-exec' process with specific command-line arguments ('trinity', 'chrome', or 'flatpak') that are often associated with malicious tools, persistence, or bypass techniques.
Detects the execution of 'docker pull' or 'docker run' commands, excluding common base images like Microsoft, Ubuntu, Debian, and Alpine. This rule aims to identify potentially unauthorized container deployments or image pulls that could indicate malicious activity within a containerized environment.
Detects kubectl exec and port-forward operations via the Kubernetes API server. 'Exec' provides interactive shell access to a running container, while 'Port-forward' allows tunneling into the pod network, potentially bypassing network policies. This rule also detects 'attach' operations.
This rule detects the creation of user namespaces on Linux systems by unprivileged users. The 'unshare' command with '--user' or '-U' flags allows a process to move into a new user namespace, which can be abused for privilege escalation or container escape. The rule specifically excludes common container runtimes and processes running as 'root' to reduce false positives.
Detects pulling of potentially malicious container images from registries
Detects shell execution inside Docker containers
Detects unauthenticated access to Docker daemon API for container escape
Detects pulling of potentially malicious container images from registries
Detects enumeration of Docker containers and images
This rule detects attempts to spawn a shell inside a container via the Docker API. Specifically, it looks for HTTP traffic directed to port 2375 (commonly used for the Docker API) containing the string "/bin/sh" in the client body, indicating a command to execute a shell.
Detects kubectl exec and port-forward operations via the Kubernetes API server. 'Exec' provides interactive shell access to a running container, while 'Port-forward' tunnels into the pod network, potentially bypassing network policies. This rule also detects 'attach' operations.
This rule detects when a 'docker exec' command is run against a running container. It specifically looks for HTTP POST requests to the '/exec' endpoint, which is used by the Docker API to create and start an exec instance inside a container. This activity could indicate an attacker gaining interactive access to a compromised container.
Detects unauthenticated access to Docker daemon API for container escape
This rule detects attempts to execute commands within a Kubernetes pod using `kubectl exec`. It specifically looks for HTTP requests to port 8080 (often used by Kubernetes API servers or proxies) with URIs containing both '/exec' and 'pods', indicating an interactive command execution session within a pod.
Detects interactive shell execution within a container in a production, using 'exec'. The execution of `cat`, followed by network connections. This could be communicating with a service that runs arbitrary commands.
This rule detects the execution of common system enumeration commands (lsblk, hostname, mount, uname) within a Docker container, when the container is run with privileged access. This activity could indicate an adversary attempting to glean information about the container environment.
Detects potential Kubernetes enumeration or attack activity via the audit log.
This includes the execution of common shells, utilities, or specialized tools like 'Rakkess' (access_matrix) and 'TruffleHog' via Kubernetes API requests.
Attackers use these methods to perform reconnaissance (enumeration), secret harvesting, or execute code (exec) within a cluster.
This includes the execution of common shells, utilities, or specialized tools like 'Rakkess' (access_matrix) and 'TruffleHog' via Kubernetes API requests.
Attackers use these methods to perform reconnaissance (enumeration), secret harvesting, or execute code (exec) within a cluster.
Detects interactive shell execution within a container in a production, using 'exec'. The execution of `cat`, followed by network connections. This would be communicating with a service that runs arbitrary commands.
Detects interactive shell execution within a container in a production Kubernetes namespace, using the 'exec' command.
Running this command in a pod allows a user to establish a temporary shell session and execute any process/commands in the pod.
Running this command in a pod allows a user to establish a temporary shell session and execute any process/commands in the pod.
The following detects interactive shell execution within a container in a production K8s namespace.
This could be indicative of an attacker with a compromised user account attempting to control a container.
This could be indicative of an attacker with a compromised user account attempting to control a container.
Detects deleting of K8s log events. Indicating Defense Evasion tactics, and covering of tracks.
Page 2 of 3