Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
219 detections
Filters
Last updated
All Time
Detection languages
70
57
56
16
8
Contributors
66
43
20
15
12
Categories
115
62
62
51
35
Platforms
182
29
28
21
17
Products / Services
10,650
9,755
6,688
4,418
3,745
MITRE Techniques
74
67
67
66
42
CVEs
2
1
1
1
1
IDS Classtypes
4
2
1
1
IDS Protocols
8
The following analytic detects suspicious image pulling in Kubernetes environments. It identifies this activity by monitoring Kubernetes audit logs for image pull requests that do not match a predefined list of allowed images. This behavior is significant for a SOC as it may indicate an attacker attempting to deploy malicious software or infiltrate the system. If confirmed malicious, the impact could be severe, potentially leading to unauthorized access to sensitive systems or data, and enabling further malicious activities within the cluster.
Detects when a request to the Kubernetes API is rejected due to lack of authorization or due to an expired authentication token being used. This may indicate an attacker attempting to leverage credentials they have obtained.
Detects when a request to the Kubernetes API is rejected due to lack of authorization or due to an expired authentication token being used.
This may indicate an attacker attempting to leverage credentials they have obtained.
This may indicate an attacker attempting to leverage credentials they have obtained.
Detects the creation, modification, or deletion of Kubernetes RoleBindings and ClusterRoleBindings in Google Cloud. These actions can indicate an adversary attempting to escalate privileges or maintain persistence within a Kubernetes cluster by granting themselves or other accounts additional roles and permissions.
This rule identifies the creation or modification of Kubernetes Jobs or CronJobs within a Google Cloud environment. Adversaries may use these scheduled tasks to maintain persistence, execute malicious code, or escalate privileges within a Kubernetes cluster by scheduling containers to run at specific times or intervals.
Identifies when an Azure Kubernetes CronJob or Job is created or modified in Azure Cloud. Adversaries may use Kubernetes CronJobs or Jobs for scheduling execution of malicious code that would run as a container in the cluster, establishing persistence or executing malicious tasks.
Identifies when an Azure Kubernetes Pod is deleted. This activity could indicate an attempt to disrupt services, evade detection, or remove evidence by an attacker. Monitoring these deletions is crucial for maintaining the integrity and availability of Kubernetes deployments.
Detects when events are deleted in Azure Kubernetes. An adversary may delete events in Azure Kubernetes in an attempt to evade detection by removing forensic evidence.
This rule identifies when Kubernetes secrets are modified or deleted within a Google Cloud Platform (GCP) environment. It specifically looks for audit log entries related to the creation, update, patch, or deletion of Kubernetes secrets.
Page 11 of 11