Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
180 detections
Filters
Last updated
All Time
Detection languages
91
29
14
14
11
Contributors
66
42
28
6
6
Categories
125
119
42
35
32
Platforms
120
95
36
27
8
Products / Services
85
38
27
21
18
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
4
3
3
2
2
IDS Classtypes
3
1
IDS Protocols
2
2
Detects potential abuse of Tailscale SSH Unix socket forwarding where the tailscaled daemon touches sensitive files/sockets (such as docker.sock or /etc/shadow) or creates/replaces Unix sockets following an SSH session.
Detects potential abuse of Tailscale SSH Unix socket forwarding where the tailscaled daemon touches sensitive files/sockets (such as docker.sock or /etc/shadow) or creates/replaces Unix sockets following an SSH session.
Detects virtualization management monitor (VMM) processes such as QEMU or Firecracker directly spawning an interactive shell, script interpreter, or network utility as the root user. This behavior is highly anomalous and may indicate a guest-to-host escape leading to remote code execution on the host.
This rule detects the use of 'docker cp' or 'sbx cp' commands which are susceptible to the CVE-2026-17106 (CopyEscape) vulnerability. This vulnerability allows a compromised container to perform arbitrary file writes or overwrites on the host system during archive extraction, potentially leading to container escape and privilege escalation by replacing critical system binaries like runc.
This detection identifies Docker containers that mount the host's root directory into the container filesystem.
Mounting the entire host root directory into a container effectively grants the container visibility and potential write access to all files on the host system.
If the container is running as root or with elevated capabilities (e.g., --privileged), the risk is significantly increased.
Mounting the entire host root directory into a container effectively grants the container visibility and potential write access to all files on the host system.
If the container is running as root or with elevated capabilities (e.g., --privileged), the risk is significantly increased.
This rule detects the use of 'docker cp' or 'sbx cp' commands which are susceptible to the CVE-2026-17106 (CopyEscape) vulnerability. This vulnerability allows a compromised container to perform arbitrary file writes or overwrites on the host system during archive extraction, potentially leading to container escape and privilege escalation by replacing critical system binaries like runc.
This rule detects potential container escape and privilege escalation attempts within a Kubernetes environment by monitoring for the creation of privileged pods, dangerous host mounts (such as /var/run/docker.sock or hostPath root mounts), and the use of escape-oriented utilities like nsenter or chroot, or access to the host's filesystem via /proc/1/root.
Detects container runtime processes (e.g., docker, podman, crictl) launching containers with elevated privilege flags (such as --privileged, --net=host, or mounting the host root directory) or pulling images from non-standard IP-based registries. These activities are indicative of potential container escapes, persistence mechanisms, or the use of untrusted/malicious container images.
Detects various techniques used to escape from Linux container isolation, including accessing container daemon control sockets (Docker/containerd), abusing namespace operations (nsenter/setns), mounting sensitive host filesystem paths (e.g., /proc/1/root), performing chroot escapes, and abusing privileged capabilities or socket-based execution.
Detects 'unshare' creating a user/mount/net namespace by a non-root user, outside
sanctioned container and sandbox runtimes. This is the shared precursor across CIFSwitch,
OVSwrap, pedit COW and container escapes. Enriched with a namespace-flag decode, an
exploit-family ProfileHint (user+net = OVSwrap shape, user+mount = CIFSwitch/overlay
shape), sandbox-lineage FP suppression, RiskScore / TriagePriority and DeviceInfo context.
Treat as a precursor/triage signal - MDE cannot tie unshare to the subsequent root
transition (no uid_change event). Detection logic adapted from Elastic Security Labs.
sanctioned container and sandbox runtimes. This is the shared precursor across CIFSwitch,
OVSwrap, pedit COW and container escapes. Enriched with a namespace-flag decode, an
exploit-family ProfileHint (user+net = OVSwrap shape, user+mount = CIFSwitch/overlay
shape), sandbox-lineage FP suppression, RiskScore / TriagePriority and DeviceInfo context.
Treat as a precursor/triage signal - MDE cannot tie unshare to the subsequent root
transition (no uid_change event). Detection logic adapted from Elastic Security Labs.
Detects the execution of the suspicious shared library 'liblocal-service.so' from the '/data/local/tmp/' directory, initiated by the 'shell' user or an ADB parent process. This activity is associated with malicious behavior where Android debug bridge (ADB) is abused to stage and execute native daemons for privilege escalation or unauthorized system access.
Detects high-risk administrative actions within a Kubernetes environment, specifically: users executing or attaching to running pods (potential container access), the creation of privileged pods (potential container escape), or modifications to Role-Based Access Control (RBAC) objects such as roles and role bindings which could lead to privilege escalation.
Detects suspicious process activity or file access patterns originating from within a container that indicate an attempt to escape to the host. This includes monitoring for the use of tools like nsenter, unshare, and mount, attempts to interact with the docker.sock, or attempts to access critical host paths like /proc/1/root or /host/etc, excluding events originating from authorized container management processes.
Detects interpreter processes (e.g., python, node, bash) typically used for AI agents accessing sensitive system files or directories outside of defined sandbox or workspace paths. This behavior suggests potential sandbox escape or unauthorized path traversal by an AI agent.
Detects incoming HTTP POST requests to the Docker API endpoint '/containers/create' containing 'Privileged: true' and a bind mount to the host filesystem ('/:/host'). This pattern is indicative of an attempt to deploy a privileged container with host access, which can be leveraged for container breakout or host system compromise.
Detects the use of the 'nsenter' utility to target the PID 1 namespace with host-level namespace flags. This technique is used by the CARBONATO botnet to escape from a privileged Docker container and execute commands on the underlying host system, leveraging the host filesystem mount.
Detects exploitation attempts by the CARBONATO botnet targeting exposed Docker daemons. The rule monitors for container escape techniques using 'nsenter' to access host namespaces, the execution of specific malicious entrypoint scripts, the use of known malicious container image references, and the creation of privileged containers with host bind mounts, which are indicative of host filesystem and network compromise.
Detects anomalous process execution originating from a Python-based sandbox (such as Semantic Kernel SessionsPythonPlugin in Azure Container Apps) that attempts to break out of the container isolation. The rule monitors for command-line arguments involving interaction with the Docker socket, sensitive host namespaces, or container privilege escalation techniques, indicative of exploitation attempts related to CVE-2026-25592.
Detects 'kubectl exec' or 'kubectl attach' requests targeting pods configured with dangerous security contexts (privileged, hostPID, or hostNetwork). The rule filters out known CI/CD service accounts to focus on potentially malicious manual or unauthorized programmatic access, which often serves as a precursor to container breakout or host-level compromise.
Detects host-side indicators of potential container escapes and unauthorized access, including mounting sensitive container runtime sockets, executing containers with privileged flags, host namespace sharing, and the use of nsenter to break out of a container context.
Detects attempts by AI agent code-interpreter or sandbox processes to break out of their containerized environment. The rule monitors for the execution of common container escape techniques, such as namespace manipulation (nsenter, unshare), mounting host filesystems, accessing sensitive host devices like /dev/kmsg or /dev/mem, or referencing host-level paths from within an isolated AI agent execution process.
Page 1 of 9