Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
15 detections
Filters
Last updated
All Time
Detection languages
4
4
3
2
1
Contributors
4
4
2
1
1
Categories
4
4
4
4
3
Platforms
7
4
4
4
1
Products / Services
5
4
3
3
2
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
4
IDS Protocols
4
Detects a single external source IP reading secrets and configmaps across multiple Kubernetes namespaces in bulk within a 1-hour window, which may indicate reconnaissance or credential theft.
Detects recovered scripts/payloads that harvest environment variables, API keys, bearer tokens, and Kubernetes secrets/configmaps into a variable named LOOT
Detects Shai-Hulud / ChainDrop activity by correlating known malicious hashes, npm/Node/Bun execution, payload artifacts, IDE persistence, credential discovery, cloud metadata access, GitHub exfiltration, C2 domains, Ethereum RPC activity, staging files, persistence artifacts, and known IOC IP connections.
Detects Shai-Hulud / ChainDrop activity by correlating known malicious hashes, npm/Node/Bun execution, payload artifacts, IDE persistence, credential discovery, cloud metadata access, GitHub exfiltration, C2 domains, Ethereum RPC activity, staging files, persistence artifacts, and known IOC IP connections.
Identifies kubectl executed from the Python payload dumping secrets across all available cluster namespaces.
This rule detects HTTP requests to the Kubernetes API endpoint '/api/v1/pods' on port 8080. This activity is indicative of an attempt to discover Kubernetes pods and services, which could be part of reconnaissance by an attacker or an authorized user.
This rule detects HTTP requests to a Docker daemon's API endpoint (port 2375) specifically targeting the '/networks' URI. This indicates an attempt to enumerate Docker network resources, which could be part of a reconnaissance phase by an attacker to understand the containerized environment.
This rule detects attempts to enumerate Kubernetes namespaces by looking for HTTP requests to the '/api/v1/namespaces' endpoint on port 8080. This activity could indicate an attacker attempting to discover available namespaces within a Kubernetes cluster.
This rule detects attempts to enumerate Docker containers via the Docker API by looking for HTTP requests containing the URI '/containers/json'. This activity could indicate an attacker performing reconnaissance on a compromised host to understand the running container environment.
Detects ServiceAccount-based enumeration of sensitive Kubernetes resources. This rule identifies when a Kubernetes ServiceAccount performs a high volume of 'get', 'list', or 'watch' operations on sensitive resources such as secrets, pods, nodes, namespaces, or other role-related resources. It specifically flags activity with 'secrets' as high severity.
Detects potential Kubernetes enumeration or attack activity via the audit log.
This includes the execution of common shells, utilities, or specialized tools like 'Rakkess' (access_matrix) and 'TruffleHog' via Kubernetes API requests.
Attackers use these methods to perform reconnaissance (enumeration), secret harvesting, or execute code (exec) within a cluster.
This includes the execution of common shells, utilities, or specialized tools like 'Rakkess' (access_matrix) and 'TruffleHog' via Kubernetes API requests.
Attackers use these methods to perform reconnaissance (enumeration), secret harvesting, or execute code (exec) within a cluster.
SPL Query from file: Enumeration of GCP Infrastructure
Detects potential container discovery by monitoring for common Linux utilities (awk, cat, grep, head, less, more, nl, tail) being used to read specific files within the '/proc' virtual filesystem. Specifically, it looks for access to '/proc/2/' (which would typically be kthreadd outside a container) or '/proc/cgroup' and '/proc/sched' which can reveal containerized environments due to differences in their content or PID mappings.
This rule detects attempts to discover if a process is running inside a Docker container by listing or reading the '.dockerenv' file. Attackers often perform container discovery to understand their environment and plan subsequent actions. The rule specifically looks for common Linux utilities like 'cat', 'ls', 'find', 'dir', 'stat', 'test', or 'grep' being executed with '.dockerenv' in their command line arguments.
Detects the execution of the 'ls -id /' command, which is a common technique used by adversaries to determine if they are running inside a container. The number of inodes for the root directory is typically much higher inside a containerized environment compared to a bare-metal system.