Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
2
Contributors
2
Categories
2
2
2
Platforms
2
2
1
Products / Services
2
1
MITRE Techniques
2
2
1
1
1
CVEs
71
71
64
58
49
Detects instances where the Argo CD repo-server or kustomize processes spawn unexpected child processes, such as shells or network utilities. This behavior is indicative of potential command injection, specifically concerning the unauthenticated GenerateManifest gRPC service vulnerability (CVE-2024-31989), where an attacker could execute arbitrary code on the underlying host or container.
Detects the execution of 'kustomize' with the '--helm-command' flag configured to use a non-standard binary or script. When triggered within the context of an Argo CD repo-server, this behavior indicates a potential exploitation attempt of CVE-2024-31989, which allows for arbitrary command execution under the repo-server process context by coercing Kustomize to execute malicious files.