Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4 detections
Filters
Last updated
All Time
Detection languages
2
1
1
Contributors
2
1
1
Categories
3
2
2
2
1
Platforms
2
1
1
1
1
Products / Services
2
1
1
1
1
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
1
IDS Protocols
1
This rule detects attempts to create a new container service via the Docker API. It specifically looks for HTTP POST requests to the '/services/create' URI on port 2375, which is the default unencrypted Docker API port. This activity could indicate an attacker attempting to establish persistence or execute malicious containers on a compromised Docker host.
KQL Query from file: Detect Power Pwn (aka LOLCopilot) Red Team Tool
The analytic detects the creation or update of privileged pods in Kubernetes. It identifies this activity by monitoring Kubernetes Audit logs for pod configurations that include root privileges. This behavior is significant for a SOC as it could indicate an attempt to escalate privileges, exploit the kernel, and gain full access to the host's namespace and devices. If confirmed malicious, this activity could lead to unauthorized access to sensitive information, data breaches, and service disruptions, posing a severe threat to the environment.
The following analytic detects the creation of a DaemonSet in a Kubernetes cluster. This behavior is identified by monitoring Kubernetes Audit logs for the creation event of a DaemonSet. DaemonSets ensure a specific pod runs on every node, making them a potential vector for persistent access. This activity is significant for a SOC as it could indicate an attempt to maintain persistent access to the Kubernetes infrastructure. If confirmed malicious, it could lead to persistent attacks, service disruptions, or unauthorized access to sensitive information.