Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
361 detections
Filters
Last updated
All Time
Detection languages
155
66
39
27
23
Contributors
84
65
37
29
27
Categories
20,440
11,814
5,871
5,145
4,864
Platforms
188
168
165
59
24
Products / Services
141
115
50
36
28
MITRE Techniques
153
125
114
85
63
CVEs
6
5
5
5
5
IDS Classtypes
9
8
3
2
1
IDS Protocols
21
1
1
Detects the execution of `kubectl` commands designed to dump all secrets across all namespaces within a Kubernetes cluster. This activity is indicative of an adversary attempting to gain access to sensitive credentials, as observed in supply chain compromises.
Detects interactive shell execution within a container in a production, using 'exec'. The execution of `cat`, followed by network connections. This would be communicating with a service that runs arbitrary commands.
Detects scripts designed for container escape and host persistence
Detects the deletion of Kubernetes log events, which could indicate an attempt at defense evasion or covering tracks by an attacker. The rule looks for 'delete' operations on 'Event' resources while excluding actions by 'ci-admin*' or 'system:*' users to reduce false positives.
Detects activity where there are role bindings and high-risk actions (verbs) applied.
This could be indicative of Privilege Escalation.
This could be indicative of Privilege Escalation.
Detects interactive shell execution within a container in a production Kubernetes namespace, using the 'exec' command.
Running this command in a pod allows a user to establish a temporary shell session and execute any process/commands in the pod.
Running this command in a pod allows a user to establish a temporary shell session and execute any process/commands in the pod.
Detects deleting of K8s log events. Indicating Defense Evasion tactics, and covering of tracks.
This detection identifies when a user or service principal executes a command inside an AKS pod ('kubectl exec') and then, using the same identity, accesses data in a sensitive Azure Blob Storage container within a short time frame. This pattern can indicate an attacker, having gained initial access to the Kubernetes API, is using a pod as a pivot point to discover and exfiltrate sensitive data.
Detects interactive administration commands (exec, attach, port-forward) within a sensitive Kubernetes namespace. Such activity can be legitimate but warrants scrutiny in high-value environments as it allows direct interaction with containerized applications and data.
Detects interactive shell execution within a container in a production Kubernetes namespace. This activity can be indicative of an attacker with a compromised user account attempting to manually control a container for exploration, privilege escalation, or data staging. Legitimate debugging by administrators may also trigger this rule.
Detects interactive shell execution within a container in a production Kubernetes namespace. This activity can be indicative of an attacker with a compromised user account attempting to manually control a container for exploration, privilege escalation, or data staging. Legitimate debugging by administrators may also trigger this rule.
Detects the RedTail cryptominer targeting exposed Docker APIs by looking for specific HTTP request patterns, including the 'libredtail-http' user agent and 'docker.selfrep' parameter in the request body.
Detects when a modification (create, update, replace, delete, or patch) action is taken that affects mutating or validating webhook configurations in Kubernetes. Adversaries can abuse these configurations to achieve persistence, exfiltrate credentials, or escalate privileges within the cluster.
Identifies when an admission controller is executed in GCP Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.
Detects the deployment of container workloads in Google Cloud Platform (GCP) that utilize the 'break-glass' flag to bypass Binary Authorization controls. This indicates an intentional override of security policies designed to ensure only trusted images are deployed, potentially allowing unauthorized or malicious container images to run.
This rule identifies when an admission controller is executed in Azure Kubernetes. Admission controllers intercept and potentially modify requests to the Kubernetes API server. Adversaries can leverage admission webhooks (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) for persistence, such as injecting malicious containers into pods or intercepting API requests to steal credentials and sensitive information.
This rule detects the creation of a Kubernetes pod with a privileged container. Privileged containers have full root capabilities on the host and can bypass many security mechanisms, making them a significant security risk. The rule specifically excludes system service accounts from the 'kube-system' namespace to reduce false positives from legitimate system operations.
This rule detects the creation of Kubernetes pods by non-system service accounts within namespaces that start with 'kube'. This could indicate an attempt to establish persistence or escalate privileges within the Kubernetes cluster by creating malicious pods in critical system namespaces.
This analytic identifies anomalously high outbound network activity from processes within Kubernetes containerized workloads. It compares recent network metrics (TCP/UDP bytes, new sockets, packets) over the last hour against the average metrics from the past 30 days. Significant deviations may indicate data exfiltration, process modification, or container compromise, potentially leading to unauthorized data transfer or further attacks within the containerized environment.
The analytic identifies anomalous inbound network traffic volumes from processes within containerized workloads. It leverages Network Performance Monitoring metrics collected via an OTEL collector and pulled from Splunk Observability Cloud. The detection compares recent metrics (tcp.bytes, tcp.new_sockets, tcp.packets, udp.bytes, udp.packets) over the last hour with the average over the past 30 days. This activity is significant as it may indicate unauthorized data reception, potential breaches, vulnerability exploitation, or malware propagation. If confirmed malicious, it could lead to command and control installation, data integrity damage, container escape, and further environment compromise.
Detects attempts to execute remote commands within a Kubernetes Pod's container, typically using the 'kubectl exec' command. This activity is logged as a 'create' verb on the 'pods' resource with the 'exec' subresource in Kubernetes audit logs.
Page 15 of 18