Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
48 detections
Filters
Last updated
All Time
Detection languages
18
14
5
3
2
Contributors
11
6
6
5
4
Categories
28
21
21
12
7
Platforms
32
10
10
5
5
Products / Services
29
6
5
5
5
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
2
IDS Protocols
2
Detects unauthorized access to unauthenticated Docker registry API endpoints on port 5000. This rule identifies catalog enumeration and the pulling of malicious container images associated with the CARBONATO botnet, including the retrieval of image manifests and configuration files that expose sensitive environment variables and credentials.
Detects file access/read of the in-cluster Kubernetes service account token path or a user's kubeconfig file by a non-standard binary (e.g. scripting interpreter, shell, or network utility) rather than known Kubernetes/orchestration tooling. Narrowed to reduce false positives from legitimate kubectl, helm, kubelet, and container runtime processes that routinely read these credentials.
Detects attempts to retrieve Azure Container Registry (ACR) credentials, either by executing specific Azure CLI commands on a host or by initiating the Microsoft.ContainerRegistry/registries/listCredentials/action via Azure Activity Logs. Such activities may indicate an adversary attempting to gain unauthorized access to container registries.
Detects AI agent processes (e.g., claude, node) executing environment enumeration commands (env, printenv) following suspected prompt injection, combined with subsequent network traffic associated with credential exfiltration patterns.
Detects network connections attempting to access Kubernetes API endpoints related to secrets. This could indicate an adversary trying to enumerate or exfiltrate sensitive credentials from a Kubernetes cluster.
Detects attempts to list, read, create, update, or delete Kubernetes secrets through the Kubernetes API server. This activity could indicate an adversary attempting to gain access to sensitive credentials or manipulate application configurations.
This rule detects network events where a device attempts to access the Kubernetes API '/api/v1/namespaces/*/secrets' endpoint. This activity could indicate an attempt to enumerate or exfiltrate sensitive information (secrets) stored within Kubernetes, potentially by an attacker who has gained initial access to a pod or compromised a service account.
Detects unauthorized processes, such as shells, scripting engines, or command-line utilities, that attempt to display or access environment variables containing sensitive cloud credential patterns (e.g., AWS_ACCESS, API_KEY). This behavior often indicates an attempt to steal cloud provider credentials from the host environment.
Detects attempts to list, read, create, update, or delete Kubernetes secrets via the Kubernetes API server. This activity can indicate an adversary attempting to gain access to sensitive information or manipulate the environment.
Detects unauthorized processes, such as shells, scripting engines, or command-line utilities, that attempt to display or access environment variables containing sensitive cloud credential patterns (e.g., AWS_ACCESS, API_KEY). This behavior often indicates an attempt to steal cloud provider credentials from the host environment.
Detects access to Kubernetes secret objects containing sensitive configuration data
Detects access to Kubernetes secret objects containing sensitive configuration data
This rule detects when a child process of npm (node, bun, or npm itself) reads a Kubernetes service account token file. This activity can indicate a compromised package attempting to access internal Kubernetes clusters from a developer's machine. Such an event warrants investigation into recent software installations or user activity, and engagement with the security team if the cause is unclear.
Detects attempts to list, read, create, update, or delete Kubernetes secrets via the Kubernetes API server. This activity could indicate an adversary attempting to gain access to sensitive information or manipulate the environment.
This rule detects attempts to access Kubernetes secret objects via the Kubernetes API. It specifically looks for HTTP requests to the '/api/v1/namespaces/' path followed by '/secrets' on port 8080. This activity could indicate an attacker attempting to exfiltrate sensitive information stored in Kubernetes secrets.
This rule detects HTTP requests to the Docker API endpoint '/containers/*/json' which could indicate an attempt to query container environment secrets. The rule specifically looks for requests to the '/containers/' path followed by '/json' in the HTTP URI.
Detects activity where one K8s client accesses many secrets in a short span.
This could be indicative of Credential access, working towards Privilege Escalation.
This could be indicative of Credential access, working towards Privilege Escalation.
Detects ServiceAccount-based enumeration of sensitive Kubernetes resources. This rule identifies when a Kubernetes ServiceAccount performs a high volume of 'get', 'list', or 'watch' operations on sensitive resources such as secrets, pods, nodes, namespaces, or other role-related resources. It specifically flags activity with 'secrets' as high severity.
Detects suspicious Kubernetes Role-Based Access Control (RBAC) changes that grant elevated privileges, such as 'cluster-admin' roles, wildcard permissions for verbs, resources, or API groups, or direct access to secrets or service accounts. This rule monitors 'create', 'update', and 'patch' operations on roles, clusterroles, rolebindings, and clusterrolebindings within Kubernetes audit logs.
This rule detects the creation, patching, or updating of Kubernetes 'clusterrolebindings', 'rolebindings', or 'roles' within 'prod', 'production', or 'default' namespaces. It specifically excludes actions performed by the 'system:clusterrole-aggregation-controller' to reduce false positives related to legitimate system operations. This activity could indicate an attempt to escalate privileges or establish persistence within critical Kubernetes environments.
Detects when a modification (create, update or replace) action is taken that affects mutating or validating webhook configurations, as they can be used by an adversary to achieve persistence or exfiltrate access credentials.
Page 1 of 3