Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
276 detections
Filters
Last updated
All Time
Detection languages
119
62
41
18
11
Contributors
55
47
38
31
18
Categories
165
71
63
63
48
Platforms
39,915
7,245
6,529
3,864
3,627
276
Products / Services
182
37
34
31
25
MITRE Techniques
91
65
61
59
52
CVEs
5
5
5
5
2
IDS Classtypes
4
3
2
2
1
IDS Protocols
11
Detects when an Azure Kubernetes Service (AKS) worker node initiates an outbound connection to a public IP address over a non-standard or unexpected port. This could indicate data exfiltration using custom tools or protocols.
Detects interactive shell execution within a container in a production Kubernetes namespace. This activity can be indicative of an attacker with a compromised user account attempting to manually control a container for exploration, privilege escalation, or data staging. Legitimate debugging by administrators may also trigger this rule.
Detects interactive shell execution within a container in a production Kubernetes namespace. This activity can be indicative of an attacker with a compromised user account attempting to manually control a container for exploration, privilege escalation, or data staging. Legitimate debugging by administrators may also trigger this rule.
Detects when a modification (create, update, replace, delete, or patch) action is taken that affects mutating or validating webhook configurations in Kubernetes. Adversaries can abuse these configurations to achieve persistence, exfiltrate credentials, or escalate privileges within the cluster.
Identifies when an admission controller is executed in GCP Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.
Detects the deployment of container workloads in Google Cloud Platform (GCP) that utilize the 'break-glass' flag to bypass Binary Authorization controls. This indicates an intentional override of security policies designed to ensure only trusted images are deployed, potentially allowing unauthorized or malicious container images to run.
This rule identifies when an admission controller is executed in Azure Kubernetes. Admission controllers intercept and potentially modify requests to the Kubernetes API server. Adversaries can leverage admission webhooks (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) for persistence, such as injecting malicious containers into pods or intercepting API requests to steal credentials and sensitive information.
This rule detects the creation of a Kubernetes pod with a privileged container. Privileged containers have full root capabilities on the host and can bypass many security mechanisms, making them a significant security risk. The rule specifically excludes system service accounts from the 'kube-system' namespace to reduce false positives from legitimate system operations.
This rule detects the creation of Kubernetes pods by non-system service accounts within namespaces that start with 'kube'. This could indicate an attempt to establish persistence or escalate privileges within the Kubernetes cluster by creating malicious pods in critical system namespaces.
KQL Query from file: Hunting IngressNightmare (CVSS 9.8)
The following analytic identifies anomalous network traffic volumes between Kubernetes workloads or between a workload and external sources. It leverages Network Performance Monitoring metrics collected via an OTEL collector and pulled from Splunk Observability Cloud. The detection compares recent network metrics (tcp.bytes, tcp.new_sockets, tcp.packets, udp.bytes, udp.packets) over the last hour with the average over the past 30 days to identify significant deviations. This activity is significant as unexpected spikes may indicate unauthorized data transfers or lateral movement. If confirmed malicious, it could lead to data exfiltration or compromise of additional services, potentially resulting in data breaches.
This analytic identifies anomalously high outbound network activity from processes within Kubernetes containerized workloads. It compares recent network metrics (TCP/UDP bytes, new sockets, packets) over the last hour against the average metrics from the past 30 days. Significant deviations may indicate data exfiltration, process modification, or container compromise, potentially leading to unauthorized data transfer or further attacks within the containerized environment.
The analytic identifies anomalous inbound network traffic volumes from processes within containerized workloads. It leverages Network Performance Monitoring metrics collected via an OTEL collector and pulled from Splunk Observability Cloud. The detection compares recent metrics (tcp.bytes, tcp.new_sockets, tcp.packets, udp.bytes, udp.packets) over the last hour with the average over the past 30 days. This activity is significant as it may indicate unauthorized data reception, potential breaches, vulnerability exploitation, or malware propagation. If confirmed malicious, it could lead to command and control installation, data integrity damage, container escape, and further environment compromise.
This analytic detects new UDP communication between a source and destination workload pair within a Kubernetes cluster. It uses Network Performance Monitoring (NPM) metrics from an OTEL collector via Splunk Observability Cloud. The detection compares network activity over the last hour with the past 30 days to identify new inter-workload communication. Such changes in network behavior can indicate potential security threats or anomalies, including unauthorized connections that may lead to data breaches, privilege escalation, lateral movement, or disruption of critical services.
This analytic identifies newly observed TCP communication between source and destination workloads within a Kubernetes cluster. It leverages Network Performance Monitoring metrics to compare recent network activity with historical data (past 30 days) to detect new inter-workload communications. Such new connections can indicate changes in application behavior or potential security threats, including unauthorized access, lateral movement, privilege escalation, data exfiltration, or disruption of critical services.
Detects attempts to execute remote commands within a Kubernetes Pod's container, typically using the 'kubectl exec' command. This activity is logged as a 'create' verb on the 'pods' resource with the 'exec' subresource in Kubernetes audit logs.
Detects attempts by an identity to enumerate its Kubernetes Role-Based Access Control (RBAC) permissions. This activity is often observed in the early stages of a breach as attackers try to understand their access within a compromised Kubernetes environment. This can be achieved by querying the Kubernetes API server's SelfSubjectRulesReview API, for example, using the "kubectl auth can-i --list" command.
Detects attempts to enumerate Kubernetes secrets, which could indicate an adversary is searching for sensitive information like API keys, tokens, or other credentials stored within the cluster.
This rule detects when an Azure Container Registry is either created or deleted. Monitoring these operations can help identify unauthorized infrastructure changes, potential resource manipulation, or attempts to cover tracks by removing evidence. An adversary might create a new container registry to host malicious images or delete an existing one to disrupt services or remove forensic artifacts.
Identifies when a Kubernetes account accesses sensitive objects such as ConfigMaps or Secrets within Azure Kubernetes Service. This rule specifically looks for write or delete operations on these objects, which could indicate unauthorized access or malicious activity.
This rule identifies when sensitive ClusterRoles or Roles are being modified, deleted, or when their permissions are being escalated or bound in Azure Kubernetes Service (AKS). These operations can indicate an attempt to gain elevated privileges or disrupt access within the Kubernetes cluster.
Page 10 of 14