Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
12 detections
Filters
Last updated
All Time
Detection languages
5
3
2
2
Contributors
3
3
2
2
1
Categories
8
5
5
2
2
Platforms
10
2
2
1
1
Products / Services
9
3
2
2
1
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
IDS Classtypes
2
IDS Protocols
2
Detects Kubernetes CronJob creation for scheduled malicious execution
This rule detects attempts to deploy a Kubernetes CronJob via the Kubernetes API. It specifically looks for HTTP requests targeting the '/apis/batch' and 'cronjobs' URI paths, indicating an interaction with the batch API group for CronJob resources. This could be an indicator of an attacker attempting to establish persistence or execute malicious code within the Kubernetes cluster by scheduling tasks.
This rule detects the creation of a Docker container via the Docker API (port 2375) where the container body content includes the string "cron" (case-insensitive). This could indicate an attempt to establish persistence or schedule malicious tasks within a Docker environment.
Identifies the use of curl to send POST requests to the Kubernetes API targeting the creation of pods. This can indicate an attacker using a stolen ServiceAccount token to deploy malicious or privileged containers.
This rule detects the creation of Kubernetes pods by non-system service accounts within namespaces that start with 'kube'. This could indicate an attempt to establish persistence or escalate privileges within the Kubernetes cluster by creating malicious pods in critical system namespaces.
KQL Query from file: Hunting IngressNightmare (CVSS 9.8)
KQL Query from file: Hunting NonEuclid RAT
Detects when a Kubernetes CronJob or Job is created, modified, or deleted. A Kubernetes Job creates one or more pods to accomplish a specific task, and a CronJob creates Jobs on a recurring schedule. An adversary can take advantage of this Kubernetes object to schedule Jobs to run containers that execute malicious code within a cluster, allowing them to achieve persistence.
The following analytic detects the creation of a Kubernetes cron job, which is a task scheduled to run automatically at specified intervals. It identifies this activity by monitoring Kubernetes Audit logs for the creation events of cron jobs. This behavior is significant for a SOC as it could allow an attacker to execute malicious tasks repeatedly and automatically, posing a threat to the Kubernetes infrastructure. If confirmed malicious, this activity could lead to persistent attacks, service disruptions, or unauthorized access to sensitive information.
The following analytic identifies processes running from newly seen paths within a Kubernetes environment. It leverages process metrics collected via an OTEL collector and hostmetrics receiver, and data is pulled from Splunk Observability Cloud using the Splunk Infrastructure Monitoring Add-on. This detection compares processes observed in the last hour with those seen over the previous 30 days. This activity is significant as it may indicate unauthorized changes, compromised nodes, or the introduction of malicious software. If confirmed malicious, it could lead to unauthorized process execution, control over critical resources, data exfiltration, privilege escalation, or malware introduction within the Kubernetes cluster.
This rule identifies the creation or modification of Kubernetes Jobs or CronJobs within a Google Cloud environment. Adversaries may use these scheduled tasks to maintain persistence, execute malicious code, or escalate privileges within a Kubernetes cluster by scheduling containers to run at specific times or intervals.
Identifies when an Azure Kubernetes CronJob or Job is created or modified in Azure Cloud. Adversaries may use Kubernetes CronJobs or Jobs for scheduling execution of malicious code that would run as a container in the cluster, establishing persistence or executing malicious tasks.