Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
180 detections
Filters
Last updated
All Time
Detection languages
91
29
14
14
11
Contributors
66
42
28
6
6
Categories
125
119
42
35
32
Platforms
120
95
36
27
8
Products / Services
85
38
27
21
18
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
4
3
3
2
2
IDS Classtypes
3
1
IDS Protocols
2
2
Detects various techniques used by an attacker to escape a container environment or gain unauthorized access to host-level resources. This includes the execution of namespace manipulation tools (nsenter, unshare, chroot), unauthorized access to the docker.sock Unix socket, mounting of host filesystems from within a container, and direct attempts to access the host's /proc/1 namespace files.
Detects activity indicative of container escape attempts, specifically identifying the use of 'docker cp' with path traversal sequences to manipulate host files, or the unauthorized execution of shells and utilities directly spawned by the container runtime daemon (dockerd). It also monitors for execution patterns associated with known container escape proof-of-concept scripts.
Detects potential container breakout or privilege escalation attempts originating from Gitea act-runner processes. The rule monitors for the execution of containers with dangerous security configurations (e.g., host PID/IPC namespace, privileged capabilities, disabled security modules) or the use of nsenter to break out of a container into the host environment.
Detects the use of the 'docker cp' command with suspicious path traversal characters or known PoC artifacts in the destination parameter. This behavior is indicative of an attempt to exploit path traversal vulnerabilities in the Docker daemon (such as those allowing container escape) by writing files outside the container's intended scope onto the host filesystem.
This rule detects two distinct malicious activities related to Gitea installations: 1) Container escape attempts involving 'act-runner' processes configured with dangerous flags like --pid=host, --cap-add=ALL, or usage of nsenter, and 2) Potential administrative impersonation attempts against a Gitea instance via injection of the X-WEBAUTH-USER: admin HTTP header.
Detects attempts to escape a Docker container to the host filesystem by exploiting directory traversal vulnerabilities within the 'docker cp' command. It identifies suspicious CLI arguments indicating path traversal, the presence of known PoC artifacts, and file write events initiated by the Docker daemon outside of expected container directory paths.
Detects execution of the 'docker cp' command containing directory traversal sequences ('../', '..") in the command line arguments. This pattern is indicative of attempts to exploit path traversal vulnerabilities to read or write files outside the intended container scope, potentially leading to container escape.
This rule detects the execution of container runners (act-runner/gitea-act-runner) with insecure container isolation flags, such as mounting the host root filesystem, disabling security profiles (seccomp/apparmor), or running with host namespaces and excessive capabilities. These configurations indicate potential container escape attempts or misconfigurations that allow significant host-level access.
Detects the creation of Kubernetes pods where the 'hostPID' or 'hostNetwork' settings are enabled. These configurations allow a pod to share the host's process namespace or network stack, respectively, which are common vectors for container escapes and host-level privilege escalation.
Detects the creation of Kubernetes pods where the 'hostPID' or 'hostNetwork' settings are enabled. These configurations allow a pod to share the host's process namespace or network stack, respectively, which are common vectors for container escapes and host-level privilege escalation.
Detects a suspicious sequence of events where a Gitea act_runner process spawns a container with dangerous namespace or capability flags (e.g., --pid=host, --cap-add=ALL) followed by the execution of 'nsenter' in the same environment, indicating an attempt to escape the container to the host.
Detects Gitea act_runner spawning Docker containers with dangerous runtime flags (e.g., --pid=host, --privileged, --cap-add=ALL) that facilitate host namespace escape. This activity is indicative of exploitation of CVE-2026-20896, where malicious CI/CD workflow YAML files inject these options to break out of the container sandbox and access the host filesystem.
Detects the use of the 'cp' command within a Docker container context to access files outside the current working directory, identified by the usage of parent directory traversal (..). This pattern is often associated with container escape attempts or unauthorized file access within a containerized environment.
Detects the execution of Gitea/Act runner or Docker containers with dangerous configurations that allow host-level access, such as privileged mode, host PID/IPC namespaces, or disabled security profiles (AppArmor/Seccomp). These configurations are often used to escape container isolation or execute commands on the underlying host.
This rule detects activities indicative of a Docker container escape, specifically targeting the 'docker cp' path traversal vulnerability. It monitors for suspicious command-line patterns involving path traversal sequences ('../'), execution of shells or common utilities from container-related processes (dockerd, containerd, etc.), and the presence of known proof-of-concept artifacts or files written outside the expected container boundary.
Detects potentially malicious container escape or privilege escalation attempts initiated by Gitea act runner processes. This includes the spawning of 'nsenter', the use of dangerous Docker flags that provide host-level access (such as host PID/IPC namespaces, all capabilities, or disabled security mechanisms), and the spawning of shells inside containers configured with namespace-entering commands.
Detects potential container escape attempts leveraging path traversal vulnerabilities in the 'docker cp' command (e.g., CVE-2026-55199). The rule identifies file creation events triggered by docker processes where the target file path is outside the expected Docker root or temporary directory structures, suggesting an effort to write files to arbitrary locations on the host filesystem.
This rule detects potential container escape attempts on Linux systems by monitoring suspicious file system access patterns to the host's root directory or process creation events involving 'mount', 'nsenter', or 'chroot' commands with parameters indicative of host interaction. Specifically, it looks for file operations on '/proc/1/root', '/proc/1/cwd', '/proc/1/exe', '/proc/1/fd', '/proc/1/ns', '/proc/1/environ', '/proc/1/mounts' or paths starting with '/host', '/hostroot', '/host-root', '/node-root'. It also flags 'mount' commands targeting '/proc/1/root', '/proc/1', 'nsenter', '--target 1', 'hostpath', or '/host', 'nsenter' commands with namespace manipulation arguments, and 'chroot' commands targeting '/proc/1/root', '/host', or '/hostroot'. These activities are commonly associated with adversaries trying to break out of a containerized environment to gain access to the underlying host.
Detects the execution of the 'unshare' utility by non-root users with flags designed to create new user or network namespaces. This behavior is often associated with container escape attempts, privilege escalation, or efforts to bypass local security controls by creating isolated environments.
Detects execution of the CVE-2026-46331 exploit chain, which utilizes unprivileged user namespace creation to escalate privileges followed by malicious Linux traffic control (tc) pedit actions to achieve kernel-level page cache corruption.
Detects potential container breakout attempts on Windows systems by monitoring for the launch of privileged containers with sensitive host paths mounted, the execution of host-level processes directly spawned by container runtime binaries (docker.exe, containerd.exe), and direct access to sensitive host filesystems (e.g., C:\windows, C:\etc, C:\programdata) by container runtimes.
Page 6 of 9