Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
361 detections
Filters
Last updated
All Time
Detection languages
155
66
39
27
23
Contributors
84
65
37
29
27
Categories
20,440
11,814
5,871
5,145
4,864
Platforms
188
168
165
59
24
Products / Services
141
115
50
36
28
MITRE Techniques
153
125
114
85
63
CVEs
6
5
5
5
5
IDS Classtypes
9
8
3
2
1
IDS Protocols
21
1
1
Detects the deployment of the ARTEX AI penetration testing framework via Docker/Docker-compose combined with the execution of offensive security and scanning tools (such as nmap, sqlmap, nuclei, httpx, apktool, frida) on the same host within a specified timeframe.
Detects a single external source IP reading secrets and configmaps across multiple Kubernetes namespaces in bulk within a 1-hour window, which may indicate reconnaissance or credential theft.
Identifies deployments of Gotenberg vulnerable to CVE-2026-42589 across multiple Microsoft Defender telemetry sources including TVM inventory, vulnerabilities, container images, listening services, and binaries on disk.
Detects potential abuse of Tailscale SSH Unix socket forwarding where the tailscaled daemon touches sensitive files/sockets (such as docker.sock or /etc/shadow) or creates/replaces Unix sockets following an SSH session.
Detects potential abuse of Tailscale SSH Unix socket forwarding where the tailscaled daemon touches sensitive files/sockets (such as docker.sock or /etc/shadow) or creates/replaces Unix sockets following an SSH session.
Detects the execution of processes associated with virtualization platforms, hypervisors, virtual machine management utilities, and containerization technologies on Windows endpoints.
The detection identifies executable names related to Microsoft Hyper-V, VMware, Oracle VirtualBox, QEMU, Xen, Parallels, WSL, and container runtimes such as Docker and containerd.
The detection identifies executable names related to Microsoft Hyper-V, VMware, Oracle VirtualBox, QEMU, Xen, Parallels, WSL, and container runtimes such as Docker and containerd.
Detects the deployment or creation of containers (via Docker, Podman, Nerdctl, Crictl, or Kubectl) with elevated risk flags such as privileged mode, host namespace sharing, root mounts, docker socket access, or initiated from web application parent processes.
The following analytic detects unauthorized container uploads to AWS Elastic Container Service (ECR) by monitoring AWS CloudTrail events.
It identifies instances where a new container is uploaded by a user not previously recognized as authorized.
It identifies instances where a new container is uploaded by a user not previously recognized as authorized.
This rule detects the use of 'docker cp' or 'sbx cp' commands which are susceptible to the CVE-2026-17106 (CopyEscape) vulnerability. This vulnerability allows a compromised container to perform arbitrary file writes or overwrites on the host system during archive extraction, potentially leading to container escape and privilege escalation by replacing critical system binaries like runc.
This detection identifies Docker containers that mount the host's root directory into the container filesystem.
Mounting the entire host root directory into a container effectively grants the container visibility and potential write access to all files on the host system.
If the container is running as root or with elevated capabilities (e.g., --privileged), the risk is significantly increased.
Mounting the entire host root directory into a container effectively grants the container visibility and potential write access to all files on the host system.
If the container is running as root or with elevated capabilities (e.g., --privileged), the risk is significantly increased.
This rule detects the use of 'docker cp' or 'sbx cp' commands which are susceptible to the CVE-2026-17106 (CopyEscape) vulnerability. This vulnerability allows a compromised container to perform arbitrary file writes or overwrites on the host system during archive extraction, potentially leading to container escape and privilege escalation by replacing critical system binaries like runc.
Detects the creation or modification of Kubernetes RoleBindings or ClusterRoleBindings that grant highly privileged roles (e.g., cluster-admin or wildcard permissions) to a subject. The detection includes behavioral analysis to identify ServiceAccount usage from unusual source IP addresses within a short timeframe, which may indicate account compromise and unauthorized privilege escalation.
This rule detects potential container escape and privilege escalation attempts within a Kubernetes environment by monitoring for the creation of privileged pods, dangerous host mounts (such as /var/run/docker.sock or hostPath root mounts), and the use of escape-oriented utilities like nsenter or chroot, or access to the host's filesystem via /proc/1/root.
Detects container runtime processes (e.g., docker, podman, crictl) launching containers with elevated privilege flags (such as --privileged, --net=host, or mounting the host root directory) or pulling images from non-standard IP-based registries. These activities are indicative of potential container escapes, persistence mechanisms, or the use of untrusted/malicious container images.
Detects various techniques used to escape from Linux container isolation, including accessing container daemon control sockets (Docker/containerd), abusing namespace operations (nsenter/setns), mounting sensitive host filesystem paths (e.g., /proc/1/root), performing chroot escapes, and abusing privileged capabilities or socket-based execution.
Detects files, such as container image layers or extracted binaries, that contain a combination of CARBONATO botnet registry infrastructure artifacts and cryptocurrency wallet application strings. This indicates the presence of a trojanized wallet application originating from the CARBONATO operators' unauthenticated registry infrastructure.
Detects evidence of cryptocurrency mining (XMRig) and suspicious process masquerading on Linux systems, alongside container-related events referencing known malicious or suspicious strings such as 'GH0ST_C2' or 'fsociety'.
Detects high-risk administrative actions within a Kubernetes environment, specifically: users executing or attaching to running pods (potential container access), the creation of privileged pods (potential container escape), or modifications to Role-Based Access Control (RBAC) objects such as roles and role bindings which could lead to privilege escalation.
Detects the creation or modification of Kubernetes RoleBindings or ClusterRoleBindings that grant highly privileged roles (e.g., cluster-admin or wildcard permissions) to a subject. The detection includes behavioral analysis to identify ServiceAccount usage from unusual source IP addresses within a short timeframe, which may indicate account compromise and unauthorized privilege escalation.
Detects suspicious process activity or file access patterns originating from within a container that indicate an attempt to escape to the host. This includes monitoring for the use of tools like nsenter, unshare, and mount, attempts to interact with the docker.sock, or attempts to access critical host paths like /proc/1/root or /host/etc, excluding events originating from authorized container management processes.
Detects interpreter processes (e.g., python, node, bash) typically used for AI agents accessing sensitive system files or directories outside of defined sandbox or workspace paths. This behavior suggests potential sandbox escape or unauthorized path traversal by an AI agent.
Page 1 of 18