Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
57 detections
Filters
Last updated
All Time
Detection languages
24
10
6
5
5
Contributors
13
9
6
5
5
Categories
44
28
14
13
6
Platforms
29
25
24
6
3
Products / Services
25
22
13
6
6
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
1
IDS Classtypes
4
2
IDS Protocols
6
This detection identifies when a user or service principal executes a command inside an AKS pod ('kubectl exec') and then, using the same identity, accesses data in a sensitive Azure Blob Storage container within a short time frame. This pattern can indicate an attacker, having gained initial access to the Kubernetes API, is using a pod as a pivot point to discover and exfiltrate sensitive data.
Detects interactive administration commands (exec, attach, port-forward) within a sensitive Kubernetes namespace. Such activity can be legitimate but warrants scrutiny in high-value environments as it allows direct interaction with containerized applications and data.
Detects interactive shell execution within a container in a production Kubernetes namespace. This activity can be indicative of an attacker with a compromised user account attempting to manually control a container for exploration, privilege escalation, or data staging. Legitimate debugging by administrators may also trigger this rule.
Detects interactive shell execution within a container in a production Kubernetes namespace. This activity can be indicative of an attacker with a compromised user account attempting to manually control a container for exploration, privilege escalation, or data staging. Legitimate debugging by administrators may also trigger this rule.
KQL Query from file: Global Admin Entra Cookie with Chrome ZeroDay
KQL Query
Looks for multiple users that had their admin role removed by a single user within a certain period.
'Looks for multiple users that had their admin role removed by a single user within a certain period.
The default threshold is 5 removals, this can be edited in the query.'
The default threshold is 5 removals, this can be edited in the query.'
Detects attempts to execute remote commands within a Kubernetes Pod's container, typically using the 'kubectl exec' command. This activity is logged as a 'create' verb on the 'pods' resource with the 'exec' subresource in Kubernetes audit logs.
Detects attempts to inject a sidecar container into a running Kubernetes deployment. This is achieved by monitoring for 'patch' operations on 'deployments' resources within the 'apps' API group. An attacker might use this technique to run their code and hide activity within a legitimate pod, rather than deploying a separate, potentially more conspicuous, pod.
Detects attempts to execute remote commands, within a Pod's container using e.g. the "kubectl exec" command.
Detects attempts to inject a sidecar container into a running deployment.
A sidecar container is an additional container within a pod, that resides alongside the main container.
One way to add containers to running resources like Deployments/DeamonSets/StatefulSets, is via a "kubectl patch" operation.
By injecting a new container within a legitimate pod, an attacker can run their code and hide their activity, instead of running their own separated pod in the cluster.
A sidecar container is an additional container within a pod, that resides alongside the main container.
One way to add containers to running resources like Deployments/DeamonSets/StatefulSets, is via a "kubectl patch" operation.
By injecting a new container within a legitimate pod, an attacker can run their code and hide their activity, instead of running their own separated pod in the cluster.
The analytic detects the creation or update of privileged pods in Kubernetes. It identifies this activity by monitoring Kubernetes Audit logs for pod configurations that include root privileges. This behavior is significant for a SOC as it could indicate an attempt to escalate privileges, exploit the kernel, and gain full access to the host's namespace and devices. If confirmed malicious, this activity could lead to unauthorized access to sensitive information, data breaches, and service disruptions, posing a severe threat to the environment.
The analytic identifies shell activity (sh, bash, csh, tcsh) within the Kubernetes privilege scope on a worker node. It leverages process metrics from an OTEL collector hostmetrics receiver, specifically process.cpu.utilization and process.memory.utilization, pulled from Splunk Observability Cloud. This activity is significant as unauthorized shell processes can indicate potential security threats, providing attackers an entry point to compromise the node and the entire Kubernetes cluster. If confirmed malicious, this activity could lead to data theft, service disruption, privilege escalation, lateral movement, and further attacks, severely compromising the cluster's security and integrity.
The analytic identifies shell activity within the Kubernetes privilege scope on a worker node, specifically when shell processes are consuming CPU resources. It leverages process metrics from an OTEL collector hostmetrics receiver, pulled from Splunk Observability Cloud via the Splunk Infrastructure Monitoring Add-on, focusing on process.cpu.utilization and process.memory.utilization. This activity is significant as unauthorized shell processes can indicate a security threat, potentially compromising the node and the entire Kubernetes cluster. If confirmed malicious, attackers could gain full control over the host's resources, leading to data theft, service disruption, privilege escalation, and further attacks within the cluster.
Page 3 of 3