Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
180 detections
Filters
Last updated
All Time
Detection languages
91
29
14
14
11
Contributors
66
42
28
6
6
Categories
125
119
42
35
32
Platforms
120
95
36
27
8
Products / Services
85
38
27
21
18
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
4
3
3
2
2
IDS Classtypes
3
1
IDS Protocols
2
2
Detects malicious interactions with an unauthenticated Docker daemon API, specifically identifying the creation of privileged containers with host bind mounts, the deployment of containers with specific naming conventions for network reconnaissance (netns-probe/net-setup), subsequent container start events, and the use of the Docker exec API to perform host namespace escapes via nsenter.
Detects reconnaissance and lateral movement activity via kubectl. The rule monitors for the enumeration of Kubernetes secrets or configmaps, and the deployment or application of privileged workloads featuring flags such as hostPath mounts, privileged execution, hostNetwork, or hostPID.
Detects reconnaissance and lateral movement activity via kubectl. The rule monitors for the enumeration of Kubernetes secrets or configmaps, and the deployment or application of privileged workloads featuring flags such as hostPath mounts, privileged execution, hostNetwork, or hostPID.
Detects the invocation of file-related functions (DownloadFileAsync, upload_file) within the Semantic Kernel framework that lack associated validation function calls. This pattern is indicative of potential Remote Code Execution (RCE) or unauthorized file system access scenarios where an LLM agent is coerced into performing dangerous file operations without path sanitization.
Detects instances where an Android application attempts to initiate an ADB wireless pairing process by connecting to the local loopback address (127.0.0.1). This behavior is characteristic of malicious applications, such as the RatHat malware, attempting to gain unauthorized ADB access to the device to bypass security sandboxes or manipulate device settings.
Detects the execution of known malicious binaries or disguised Go-based daemons (such as frpc, liblocal-service, or libmedia_codec) within the /data/local/tmp/ directory by the Android 'shell' user. This activity is indicative of Rathat malware or similar threats leveraging ADB for persistent C2 communication.
Detects exploitation attempts by the CARBONATO botnet targeting exposed Docker daemons. The rule monitors for container escape techniques using 'nsenter' to access host namespaces, the execution of specific malicious entrypoint scripts, the use of known malicious container image references, and the creation of privileged containers with host bind mounts, which are indicative of host filesystem and network compromise.
Detects exploitation attempts by the CARBONATO botnet targeting exposed Docker daemons. The rule monitors for container escape techniques using 'nsenter' to access host namespaces, the execution of specific malicious entrypoint scripts, the use of known malicious container image references, and the creation of privileged containers with host bind mounts, which are indicative of host filesystem and network compromise.
Detects exploitation attempts by the CARBONATO botnet targeting exposed Docker daemons. The rule monitors for container escape techniques using 'nsenter' to access host namespaces, the execution of specific malicious entrypoint scripts, the use of known malicious container image references, and the creation of privileged containers with host bind mounts, which are indicative of host filesystem and network compromise.
Detects exploitation attempts by the CARBONATO botnet targeting exposed Docker daemons. The rule monitors for container escape techniques using 'nsenter' to access host namespaces, the execution of specific malicious entrypoint scripts, the use of known malicious container image references, and the creation of privileged containers with host bind mounts, which are indicative of host filesystem and network compromise.
This rule detects processes attempting to interact with the Docker daemon via its Unix domain socket (/var/run/docker.sock). This is a common technique used by attackers to escape from a container, gain host-level control, or execute arbitrary container administration commands.
Detects the execution of the Linux 'unshare' utility to create new namespaces (user or network). This command is often used as a primitive for container escapes or privilege escalation by allowing an unprivileged user to create isolated environments. The rule excludes common container management and virtualization tools to reduce noise.
Detects a sequence of events where a process within a container namespace attempts to interact with the host filesystem (e.g., /proc/1/root, nsenter) followed shortly by an unexpected gain of root privileges or execution of setuid(0) that is not associated with legitimate su or sudo usage.
This rule detects kernel-level stability issues or crashes (ah6/ipsec related) occurring immediately after the execution of processes that create new user namespaces (unshare, clone with CLONE_NEWUSER). This pattern is often associated with exploitation of kernel vulnerabilities, where namespace manipulation is a prerequisite for triggering a crash or privilege escalation.
This rule detects kernel-level stability issues or crashes (ah6/ipsec related) occurring immediately after the execution of processes that create new user namespaces (unshare, clone with CLONE_NEWUSER). This pattern is often associated with exploitation of kernel vulnerabilities, where namespace manipulation is a prerequisite for triggering a crash or privilege escalation.
Detects the execution of the Linux 'unshare' utility to create new namespaces (user or network). This command is often used as a primitive for container escapes or privilege escalation by allowing an unprivileged user to create isolated environments. The rule excludes common container management and virtualization tools to reduce noise.
Detects the execution of the Linux 'unshare' utility to create new namespaces (user or network). This command is often used as a primitive for container escapes or privilege escalation by allowing an unprivileged user to create isolated environments. The rule excludes common container management and virtualization tools to reduce noise.
Detects the execution of the Linux 'unshare' utility to create new namespaces (user or network). This command is often used as a primitive for container escapes or privilege escalation by allowing an unprivileged user to create isolated environments. The rule excludes common container management and virtualization tools to reduce noise.
Detects unauthorized programmatic invocation of ADB pair or connect commands by an Android application. This activity is indicative of the RatHat malware family attempting to abuse Accessibility Services and Wireless Debugging to self-pair with the local ADB daemon, thereby bypassing the Android application sandbox.
Detects unauthorized attempts to manipulate cgroup files (e.g., cgroup.procs) within Kubernetes pods using kubectl exec/attach sessions. This technique is often associated with SPIRE attestation spoofing or container escape attempts where an attacker attempts to influence process management or isolation constraints from within the container via the Kubernetes API.
Detects command-line activity indicating an attempt to interact with or abuse the Docker socket (/var/run/docker.sock) for container escape. Such activity is often observed in post-compromise scenarios, such as ransomware attacks where an adversary attempts to break out of a containerized application to gain control of the underlying host.
Page 2 of 9