Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
258 detections
Filters
Last updated
All Time
Detection languages
117
32
27
22
16
Contributors
99
60
33
25
8
Categories
187
123
62
59
44
Platforms
39,951
7,276
6,526
3,865
3,641
258
Products / Services
146
48
47
28
22
MITRE Techniques
95
94
69
57
41
CVEs
10
5
5
5
5
IDS Classtypes
9
7
4
3
2
IDS Protocols
23
3
1
Detects execution of the CVE-2026-46331 exploit chain, which utilizes unprivileged user namespace creation to escalate privileges followed by malicious Linux traffic control (tc) pedit actions to achieve kernel-level page cache corruption.
Detects unauthorized processes, such as shells, scripting engines, or command-line utilities, that attempt to display or access environment variables containing sensitive cloud credential patterns (e.g., AWS_ACCESS, API_KEY). This behavior often indicates an attempt to steal cloud provider credentials from the host environment.
Detects potential container breakout attempts on Windows systems by monitoring for the launch of privileged containers with sensitive host paths mounted, the execution of host-level processes directly spawned by container runtime binaries (docker.exe, containerd.exe), and direct access to sensitive host filesystems (e.g., C:\windows, C:\etc, C:\programdata) by container runtimes.
This rule detects potentially malicious activity within Linux environments or containers where a single user context concurrently performs credential hunting (via environment variable dumping or accessing .env files) and terminates processes associated with known cryptocurrency miners or competing malicious actors. This behavior is highly indicative of a cryptojacking infection or a malicious actor clearing out existing resource-hijacking threats.
Detects various techniques used by an attacker to escape a container environment or gain unauthorized access to host-level resources. This includes the execution of namespace manipulation tools (nsenter, unshare, chroot), unauthorized access to the docker.sock Unix socket, mounting of host filesystems from within a container, and direct attempts to access the host's /proc/1 namespace files.
Detects repeated restarts of vLLM pods (due to OOMKilled, CrashLoopBackOff, or other failure reasons) that are correlated with a burst of multimodal requests. This pattern can indicate a denial-of-service attack, resource exhaustion, or exploitation of vulnerabilities (such as CVE-2026-22778) targeting the vLLM service, potentially leading to service instability or compromise.
This rule monitors network traffic for suspicious patterns indicating exploitation of LocalStack environments. It detects three primary malicious activities: Velocity Template Language (VTL) injection targeting reflection methods (e.g., ProcessBuilder) for RCE; unauthorized manipulation of API Gateway resources (e.g., creating or modifying deployments) accompanied by IAM scope bypass techniques; and direct execution of RCE-style API triggers against known LocalStack port 4566.
Detects potential container breakout attempts on Windows systems by monitoring for the launch of privileged containers with sensitive host paths mounted, the execution of host-level processes directly spawned by container runtime binaries (docker.exe, containerd.exe), and direct access to sensitive host filesystems (e.g., C:\windows, C:\etc, C:\programdata) by container runtimes.
This rule detects suspicious activity involving Docker containers, specifically focusing on path traversal attempts via the 'docker cp' command, execution of potential proof-of-concept scripts, or the creation of specific marker files indicating attempts to interact with or escape from the containerized environment to the underlying host.
Detects attempts to perform a container escape using path traversal via the 'docker cp' command. This rule monitors for malicious directory traversal sequences, the creation of specific artifacts used in known PoC exploits for container escapes, and the subsequent execution of scripts or shell interpreters by container management processes.
This rule detects potentially malicious activities within or involving Docker containers on Linux systems. It specifically monitors for the use of 'docker cp' with archive flags, the execution of custom scripts ('poc.sh') involving docker-related commands, or the use of 'docker-cp-copyout' strings, which may indicate data staging, exfiltration, or container-based persistence and lateral movement.
This rule detects potentially malicious attempts to escape a container or manipulate the host filesystem using the 'docker cp' command. It identifies commands that contain directory traversal patterns (e.g., '../', '..\') or direct references to the host filesystem via '/proc/self/root'.
Detects attempts to perform a container escape using the 'docker cp' command, where a maliciously crafted source path with traversal sequences allows the container daemon to write files outside of the container boundary. The rule monitors for suspicious 'docker cp' command executions and the creation of artifacts associated with known path traversal escape techniques in the host filesystem by the Docker daemon.
Detects the use of 'docker cp' to copy files to or from sensitive host paths, such as cron, password files, SSH keys, or system directories, which often indicates attempts to escape container isolation or establish persistence on the host.
Detects the execution of 'docker pull' or 'docker run' commands, excluding common base images like Microsoft, Ubuntu, Debian, and Alpine. This rule aims to identify potentially unauthorized container deployments or image pulls that could indicate malicious activity within a containerized environment.
Detects access to sensitive GCP credential-related files or the presence of credential-related environment variables/secrets in command lines and network request bodies. This pattern is often associated with the theft of service account keys or environment-based cloud credentials, frequently seen in serverless or containerized environments.
Detects the use of 'docker cp' commands containing path traversal sequences (e.g., '..') in the destination argument. This behavior is indicative of an attempt to escape the container environment and write files to the host filesystem, potentially exploiting the 'docker-cp-copyout' vulnerability.
Detects the presence of PIL exception messages in application logs that leak heap memory addresses. This is the first stage of the CVE-2026-22778 exploitation chain against vLLM instances used to bypass ASLR.
Detects the execution of container-related binaries (act_runner, docker, dockerd) using sensitive command-line flags that indicate potential container escape or high-privilege configuration, such as mounting the host namespace, running in privileged mode, or leaking CI/CD tokens.
Detects Gitea Act Runner spawning Docker containers with high-risk security options (e.g., --privileged, --pid=host, --ipc=host, --cap-add=ALL, or security profile unconfined). These flags are often used to attempt a container escape, allowing a process running within a Gitea CI/CD workflow to gain unauthorized access to the underlying host or other container resources.
Detects anomalous process execution and filesystem access patterns originating from Gitea Act Runner that indicate an attempted container-to-host escape. This includes the injection of dangerous container flags (e.g., --pid=host, --privileged, --cap-add=ALL) into workflow commands, the execution of nsenter, or direct access to the host's filesystem structures (e.g., /host or /proc/1/root).
Page 10 of 13