Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
66 detections
Filters
Last updated
All Time
Detection languages
23
10
8
7
6
Contributors
28
8
5
4
4
Categories
63
27
15
13
13
Platforms
35
33
29
7
6
Products / Services
36
26
8
7
6
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
CVEs
3
1
1
IDS Classtypes
4
4
IDS Protocols
8
Detects the creation of Kubernetes pods where the 'hostPID' or 'hostNetwork' settings are enabled. These configurations allow a pod to share the host's process namespace or network stack, respectively, which are common vectors for container escapes and host-level privilege escalation.
Detects the execution of container-related binaries (act_runner, docker, dockerd) using sensitive command-line flags that indicate potential container escape or high-privilege configuration, such as mounting the host namespace, running in privileged mode, or leaking CI/CD tokens.
Detects Gitea Act Runner spawning Docker containers with high-risk security options (e.g., --privileged, --pid=host, --ipc=host, --cap-add=ALL, or security profile unconfined). These flags are often used to attempt a container escape, allowing a process running within a Gitea CI/CD workflow to gain unauthorized access to the underlying host or other container resources.
Detects anomalous process execution and filesystem access patterns originating from Gitea Act Runner that indicate an attempted container-to-host escape. This includes the injection of dangerous container flags (e.g., --pid=host, --privileged, --cap-add=ALL) into workflow commands, the execution of nsenter, or direct access to the host's filesystem structures (e.g., /host or /proc/1/root).
Detects the Gitea Act Runner CI/CD tool executing Docker containers with dangerous security flags (such as --privileged, --pid=host, or --cap-add=ALL) or spawning nsenter to interact with host namespaces. This behavior indicates a potential attempt to escape the container boundary and gain unauthorized root-level access on the underlying CI/CD runner host.
Detects anomalous process execution patterns associated with the Gitea Act Runner that indicate attempts to break out of container isolation. This includes the use of sensitive Docker flags like --privileged, --pid=host, or --ipc=host, the mounting of the Docker daemon socket, or the execution of nsenter to gain access to the host namespace, which are indicative of container escape techniques.
Detects the creation of Kubernetes pods with dangerous security settings that could lead to container escape or privilege escalation. This includes configurations such as hostNetwork enabled, allowPrivilegeEscalation set to true, or running as root (runAsUser = 0). The rule specifically monitors 'io.k8s.core.v1.pods.create' operations in cloud audit logs.
This rule detects attempts to deploy a malicious pod via the Kubernetes API. It specifically looks for HTTP POST requests to the '/api/v1/namespaces/' endpoint followed by '/pods', indicating an attempt to create a new pod within a Kubernetes namespace.
Detects deployment of privileged Docker containers that may allow container escape
Detects the creation or deletion of Kubernetes namespaces and nodes via the API server. This activity can indicate an adversary attempting to establish persistence, expand their control, or disrupt the environment within a Kubernetes cluster.
Detects the creation of Kubernetes pods with dangerous security settings that could lead to privilege escalation or container escape. This includes configurations such as enabling hostNetwork, allowing privilege escalation within containers, or running containers as the root user (UID 0).
This rule detects the deployment of a new privileged container via the Docker API. It specifically looks for HTTP requests to the '/containers/create' endpoint with 'Privileged' in the client body, indicating an attempt to create a container with elevated privileges. This activity can be indicative of an attacker attempting to gain higher access or persistence within a compromised system by deploying a malicious container.
This rule detects attempts to deploy a container with host network mode enabled. It specifically looks for HTTP requests to the '/containers/create' endpoint, which is commonly used by container orchestration systems like Docker, and checks for the presence of 'host' within the HTTP client body, indicating the host network mode configuration. This can be a security concern as it allows the container to have direct access to the host's network interfaces, potentially bypassing network segmentation and security controls.
Detects workloads created with privileged mode, host namespace sharing, dangerous Linux capabilities, Docker socket, containerd socket, or sensitive hostPath mounts. These configurations can be abused by adversaries to escape containers and gain access to the underlying host.
Docker Run/Exec Guardrails Bypass
Cortex XDR
This rule detects the execution of a Docker command with the '--privileged' flag on a Linux system, combined with the execution of specific system information gathering commands. This combination is often indicative of an attempt to escape a container or gain elevated privileges within a containerized environment, potentially leading to host compromise. The '--privileged' flag grants a container nearly all capabilities of the host machine, making it a critical security concern when used maliciously.
etects the full TeamPCP lateral movement pattern: listing secrets across namespaces followed by privileged alpine pod creation in kube-system. Correlation rule.
Detects the creation of highly privileged Kubernetes pods in the 'kube-system' namespace matching the naming convention 'node-setup-*', indicative of TeamPCP lateral movement techniques. These pods request elevated privileges such as 'hostPID', 'hostNetwork', and 'privileged'.
This rule detects activities associated with UNC6201 exploitation of Dell RecoverPoint VM, specifically looking for three distinct phases: Tomcat Manager WAR file deployment, modification of a persistence script on Linux, and communication with a GRIMBOLT C2 endpoint. The first part identifies WAR file deployments via Tomcat Manager. The second part looks for modifications to a specific persistence script file. The third part identifies network connections to a known GRIMBOLT C2 IP address or URL pattern.
This rule detects the creation of a Kubernetes pod with a privileged container. Privileged containers have full root capabilities on the host and can bypass many security mechanisms, making them a significant security risk. The rule specifically excludes system service accounts from the 'kube-system' namespace to reduce false positives from legitimate system operations.
This rule detects when an Azure Container Registry is either created or deleted. Monitoring these operations can help identify unauthorized infrastructure changes, potential resource manipulation, or attempts to cover tracks by removing evidence. An adversary might create a new container registry to host malicious images or delete an existing one to disrupt services or remove forensic artifacts.
The analytic detects the creation or update of privileged pods in Kubernetes. It identifies this activity by monitoring Kubernetes Audit logs for pod configurations that include root privileges. This behavior is significant for a SOC as it could indicate an attempt to escalate privileges, exploit the kernel, and gain full access to the host's namespace and devices. If confirmed malicious, this activity could lead to unauthorized access to sensitive information, data breaches, and service disruptions, posing a severe threat to the environment.
Page 3 of 4