Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
66 detections
Filters
Last updated
All Time
Detection languages
23
10
8
7
6
Contributors
28
8
5
4
4
Categories
63
27
15
13
13
Platforms
35
33
29
7
6
Products / Services
36
26
8
7
6
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
CVEs
3
1
1
IDS Classtypes
4
4
IDS Protocols
8
Detects the deployment of an Azure Container Instance (ACI) where the image source or container name matches identified indicators of a potentially compromised registry or unauthorized deployment pattern.
Detects the execution of an Azure Container Registry (ACR) task utilizing a specifically named 'secret-task.yaml' file, which is often associated with adversary attempts to leverage cloud automation for malicious container deployment or secret exfiltration.
Detects build process content (likely within a Dockerfile or CI/CD script) that installs 'netcat' and initiates a multi-architecture build and push operation to a specific container registry path (registryfr.azurecr.io/mongo:latest), which may indicate the creation of a backdoored or malicious container image.
Detects attempts to perform container escapes or escalate privileges within a Gitea Actions runner environment. The rule monitors for the execution of dangerous container options (e.g., --pid=host, --privileged, --cap-add=ALL) in CI/CD workflow configurations, the spawning of 'nsenter' by the runner process, and writes to sensitive host system paths from containerized processes.
Detects Gitea act_runner spawning Docker containers with dangerous runtime flags (e.g., --pid=host, --privileged, --cap-add=ALL) that facilitate host namespace escape. This activity is indicative of exploitation of CVE-2026-20896, where malicious CI/CD workflow YAML files inject these options to break out of the container sandbox and access the host filesystem.
Detects the creation of Kubernetes pods where the 'hostPID' or 'hostNetwork' settings are enabled. These configurations allow a pod to share the host's process namespace or network stack, respectively, which are common vectors for container escapes and host-level privilege escalation.
This rule detects the execution of Docker containers or related CI/CD runner processes (like Gitea act_runner) with insecure configuration options. These options, such as --privileged, --pid=host, or mounting the Docker socket, can facilitate container escapes or unauthorized host-level access.
Detects suspicious execution patterns originating from Gitea act_runner that indicate potential container escape attempts or host namespace manipulation. The rule flags the use of sensitive docker flags such as --pid=host, --ipc=host, --cap-add=ALL, and security profile unconfining, alongside the execution of 'nsenter' or the existence of specific proof-of-concept markers related to container escape vulnerabilities.
Detects the creation of Kubernetes pods with dangerous security settings that could lead to container escape or privilege escalation. This includes pods configured with hostNetwork enabled, allowing privilege escalation, running as root (UID 0), or abusing capabilities.
Detects the creation or deletion of Kubernetes namespaces and nodes via the Kubernetes API server. This activity can indicate an adversary attempting to establish persistence, expand their control, or disrupt the environment.
This rule detects two distinct malicious activities related to Gitea installations: 1) Container escape attempts involving 'act-runner' processes configured with dangerous flags like --pid=host, --cap-add=ALL, or usage of nsenter, and 2) Potential administrative impersonation attempts against a Gitea instance via injection of the X-WEBAUTH-USER: admin HTTP header.
This rule detects the execution of container runners (act-runner/gitea-act-runner) with insecure container isolation flags, such as mounting the host root filesystem, disabling security profiles (seccomp/apparmor), or running with host namespaces and excessive capabilities. These configurations indicate potential container escape attempts or misconfigurations that allow significant host-level access.
This rule detects potential Mythic C2 implant or payload build activity occurring via Docker. It monitors for executions of docker.exe, docker-compose.exe, or docker commands initiated by shells (cmd.exe, powershell.exe) containing keywords associated with the Mythic C2 framework, while explicitly excluding common CI/CD runner parent processes to reduce noise.
Detects the creation of Kubernetes pods where the 'hostPID' or 'hostNetwork' settings are enabled. These configurations allow a pod to share the host's process namespace or network stack, respectively, which are common vectors for container escapes and host-level privilege escalation.
Detects the creation of Kubernetes pods where the 'hostPID' or 'hostNetwork' settings are enabled. These configurations allow a pod to share the host's process namespace or network stack, respectively, which are common vectors for container escapes and host-level privilege escalation.
Detects a suspicious sequence of events where a Gitea act_runner process spawns a container with dangerous namespace or capability flags (e.g., --pid=host, --cap-add=ALL) followed by the execution of 'nsenter' in the same environment, indicating an attempt to escape the container to the host.
Detects Gitea act_runner spawning Docker containers with dangerous runtime flags (e.g., --pid=host, --privileged, --cap-add=ALL) that facilitate host namespace escape. This activity is indicative of exploitation of CVE-2026-20896, where malicious CI/CD workflow YAML files inject these options to break out of the container sandbox and access the host filesystem.
This rule detects potential Mythic C2 implant or payload build activity occurring via Docker. It monitors for executions of docker.exe, docker-compose.exe, or docker commands initiated by shells (cmd.exe, powershell.exe) containing keywords associated with the Mythic C2 framework, while explicitly excluding common CI/CD runner parent processes to reduce noise.
Detects the creation or deletion of Kubernetes namespaces and nodes via the API server. This activity can indicate an adversary attempting to establish persistence, expand their control, or disrupt the environment within a Kubernetes cluster.
This rule detects suspicious activity involving Docker containers, specifically focusing on path traversal attempts via the 'docker cp' command, execution of potential proof-of-concept scripts, or the creation of specific marker files indicating attempts to interact with or escape from the containerized environment to the underlying host.
This rule detects potentially malicious activities within or involving Docker containers on Linux systems. It specifically monitors for the use of 'docker cp' with archive flags, the execution of custom scripts ('poc.sh') involving docker-related commands, or the use of 'docker-cp-copyout' strings, which may indicate data staging, exfiltration, or container-based persistence and lateral movement.
Page 2 of 4