Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
258 detections
Filters
Last updated
All Time
Detection languages
117
32
27
22
16
Contributors
99
60
33
25
8
Categories
187
123
62
59
44
Platforms
39,951
7,276
6,526
3,865
3,641
258
Products / Services
146
48
47
28
22
MITRE Techniques
95
94
69
57
41
CVEs
10
5
5
5
5
IDS Classtypes
9
7
4
3
2
IDS Protocols
23
3
1
Detects the use of lifecycle hooks in `.devcontainer/devcontainer.json` files to execute potentially malicious commands. Adversaries can abuse hooks like `postCreateCommand` or `postStartCommand` in development environments like GitHub Codespaces to automatically run scripts upon container creation. This can be used to exfiltrate secrets, such as GitHub tokens, or establish further access.
Detects the use of lifecycle hooks in `.devcontainer/devcontainer.json` files to execute potentially malicious commands. Adversaries can abuse hooks like `postCreateCommand` or `postStartCommand` in development environments like GitHub Codespaces to automatically run scripts upon container creation. This can be used to exfiltrate secrets, such as GitHub tokens, or establish further access.
Detects privilege escalation attempts used by the Shai-Hulud malware. This includes checking for passwordless sudo ('sudo -n true') and exploiting Docker to modify the 'sudoers.d' file to grant root privileges.
Detects the RedTail cryptominer targeting exposed Docker APIs by looking for specific HTTP request patterns, including the 'libredtail-http' user agent and 'docker.selfrep' parameter in the request body.
Detects potential container discovery by monitoring for common Linux utilities (awk, cat, grep, head, less, more, nl, tail) being used to read specific files within the '/proc' virtual filesystem. Specifically, it looks for access to '/proc/2/' (which would typically be kthreadd outside a container) or '/proc/cgroup' and '/proc/sched' which can reveal containerized environments due to differences in their content or PID mappings.
This rule detects attempts to discover if a process is running inside a Docker container by listing or reading the '.dockerenv' file. Attackers often perform container discovery to understand their environment and plan subsequent actions. The rule specifically looks for common Linux utilities like 'cat', 'ls', 'find', 'dir', 'stat', 'test', or 'grep' being executed with '.dockerenv' in their command line arguments.
Page 13 of 13