Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
258 detections
Filters
Last updated
All Time
Detection languages
117
32
27
22
16
Contributors
99
60
33
25
8
Categories
187
123
62
59
44
Platforms
39,951
7,276
6,526
3,865
3,641
258
Products / Services
146
48
47
28
22
MITRE Techniques
95
94
69
57
41
CVEs
10
5
5
5
5
IDS Classtypes
9
7
4
3
2
IDS Protocols
23
3
1
Detects the Gitea Act Runner CI/CD tool executing Docker containers with dangerous security flags (such as --privileged, --pid=host, or --cap-add=ALL) or spawning nsenter to interact with host namespaces. This behavior indicates a potential attempt to escape the container boundary and gain unauthorized root-level access on the underlying CI/CD runner host.
Detects anomalous process execution patterns associated with the Gitea Act Runner that indicate attempts to break out of container isolation. This includes the use of sensitive Docker flags like --privileged, --pid=host, or --ipc=host, the mounting of the Docker daemon socket, or the execution of nsenter to gain access to the host namespace, which are indicative of container escape techniques.
Detects unauthorized processes, such as shells, scripting engines, or command-line utilities, that attempt to display or access environment variables containing sensitive cloud credential patterns (e.g., AWS_ACCESS, API_KEY). This behavior often indicates an attempt to steal cloud provider credentials from the host environment.
This rule detects suspicious activity involving container runtimes (e.g., Docker) that indicates potential container escape attempts or unauthorized host interaction. It flags scenarios where container processes spawn administrative shells (cmd.exe, powershell.exe) with SYSTEM privileges, instances of privileged container creation, or direct access to physical drives from container management tools, which are common indicators of host filesystem manipulation.
This rule detects suspicious activity involving container runtimes (e.g., Docker) that indicates potential container escape attempts or unauthorized host interaction. It flags scenarios where container processes spawn administrative shells (cmd.exe, powershell.exe) with SYSTEM privileges, instances of privileged container creation, or direct access to physical drives from container management tools, which are common indicators of host filesystem manipulation.
Detects attempts to perform a container escape via the docker cp command by abusing path traversal vulnerabilities or suspicious file write operations performed by the Docker daemon to the host filesystem outside of standard container paths, often associated with symbolic link extraction exploits.
This rule detects potential container escape attempts on Linux systems by monitoring suspicious file system access patterns to the host's root directory or process creation events involving 'mount', 'nsenter', or 'chroot' commands with parameters indicative of host interaction. Specifically, it looks for file operations on '/proc/1/root', '/proc/1/cwd', '/proc/1/exe', '/proc/1/fd', '/proc/1/ns', '/proc/1/environ', '/proc/1/mounts' or paths starting with '/host', '/hostroot', '/host-root', '/node-root'. It also flags 'mount' commands targeting '/proc/1/root', '/proc/1', 'nsenter', '--target 1', 'hostpath', or '/host', 'nsenter' commands with namespace manipulation arguments, and 'chroot' commands targeting '/proc/1/root', '/host', or '/hostroot'. These activities are commonly associated with adversaries trying to break out of a containerized environment to gain access to the underlying host.
Detects the presence of PIL exception messages in application logs that leak heap memory addresses. This is the first stage of the CVE-2026-22778 exploitation chain against vLLM instances used to bypass ASLR.
Detects the command line sequence used by Miasma to restore passwordless sudo for the 'runner' user in GitHub Actions by overwriting sudoers via a Docker container. This specific pattern targets the Miasma Alpine container payload.
Detects pulling of potentially malicious container images from registries
Detects the command line sequence used by Miasma to restore passwordless sudo for the 'runner' user in GitHub Actions by overwriting sudoers via a Docker container. This specific sequence involves echoing 'runner ALL=(ALL) NOPASSWD:ALL' into a file within the /mnt/runner directory and then changing its permissions to 0440, indicative of a privileged modification to the sudoers file within a containerized GitHub Actions runner environment.
Detects shell execution inside Docker containers
Detects unauthenticated access to Docker daemon API for container escape
Detects pulling of potentially malicious container images from registries
Detects upload of backdoored container images to internal registries
Detects enumeration of Docker containers and images
Detects creation of malicious container services via Docker API for persistence
Detects deployment of privileged Docker containers that may allow container escape
This rule detects attempts to submit a Dockerfile containing 'FROM' and 'RUN' instructions to the Docker API via an HTTP POST request to the '/build' endpoint. This activity could indicate an attacker attempting to build a malicious Docker image on a compromised Docker host.
Docker Image Enumeration via API
Suricata
This rule detects attempts to enumerate Docker images via the Docker API. Specifically, it looks for HTTP requests to the '/images/json' endpoint on TCP port 2375, which is commonly used for unauthenticated Docker API access. This activity can indicate an adversary performing reconnaissance on a system to understand its Docker environment.
This rule detects attempts to pull a Docker image via an unauthenticated Docker API. Specifically, it looks for HTTP requests to the '/images/create' endpoint on port 2375, which is the default unauthenticated Docker API port. This activity could indicate an attacker exploiting an exposed Docker daemon to deploy malicious images or gain further access to the host system.
Page 11 of 13