Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
276 detections
Filters
Last updated
All Time
Detection languages
119
62
41
18
11
Contributors
55
47
38
31
18
Categories
165
71
63
63
48
Platforms
39,916
7,245
6,529
3,864
3,627
276
Products / Services
182
37
34
31
25
MITRE Techniques
91
65
61
59
52
CVEs
5
5
5
5
2
IDS Classtypes
4
3
2
2
1
IDS Protocols
11
Detects when a namespace-scoped identity creates, updates, or patches AWS or Azure IAM-related custom resources in Kubernetes. This pattern monitors for a 'confused deputy' scenario where a user might attempt to leverage high-privilege cloud operators (like ACK or ASO v2) that operate with a shared high-privilege identity to modify cloud IAM configurations.
This rule detects unauthorized attempts by non-automation Kubernetes users to create or update IAM policies for Google Cloud resources via Config Connector (KCC). It specifically monitors for actions that assign high-privilege roles (e.g., Organization Owner, Organization Admin) to Organization-scoped resources, excluding authorized platform service accounts and KCC reconciliation traffic.
This rule detects unauthorized attempts by non-automation Kubernetes users to create or update IAM policies for Google Cloud resources via Config Connector (KCC). It specifically monitors for actions that assign high-privilege roles (e.g., Organization Owner, Organization Admin) to Organization-scoped resources, excluding authorized platform service accounts and KCC reconciliation traffic.
This rule detects unauthorized attempts by non-automation Kubernetes users to create or update IAM policies for Google Cloud resources via Config Connector (KCC). It specifically monitors for actions that assign high-privilege roles (e.g., Organization Owner, Organization Admin) to Organization-scoped resources, excluding authorized platform service accounts and KCC reconciliation traffic.
This rule detects unauthorized attempts by non-automation Kubernetes users to create or update IAM policies for Google Cloud resources via Config Connector (KCC). It specifically monitors for actions that assign high-privilege roles (e.g., Organization Owner, Organization Admin) to Organization-scoped resources, excluding authorized platform service accounts and KCC reconciliation traffic.
This rule detects unauthorized attempts by non-automation Kubernetes users to create or update IAM policies for Google Cloud resources via Config Connector (KCC). It specifically monitors for actions that assign high-privilege roles (e.g., Organization Owner, Organization Admin) to Organization-scoped resources, excluding authorized platform service accounts and KCC reconciliation traffic.
Detects Kubernetes RBAC Role or ClusterRole creation or update events that grant the 'create' verb on Config Connector (KCC) IAM custom resources (iampolicymembers, iampolicies, iampartialpolicies) by non-approved user identities. This could indicate an attempt to gain unauthorized control over cloud IAM policies through the Kubernetes API.
Detects Kubernetes RBAC Role or ClusterRole creation or update events that grant the 'create' verb on Config Connector (KCC) IAM custom resources (iampolicymembers, iampolicies, iampartialpolicies) by non-approved user identities. This could indicate an attempt to gain unauthorized control over cloud IAM policies through the Kubernetes API.
Detects Kubernetes RBAC Role or ClusterRole creation or update events that grant the 'create' verb on Config Connector (KCC) IAM custom resources (iampolicymembers, iampolicies, iampartialpolicies) by non-approved user identities. This could indicate an attempt to gain unauthorized control over cloud IAM policies through the Kubernetes API.
Detects Kubernetes RBAC Role or ClusterRole creation or update events that grant the 'create' verb on Config Connector (KCC) IAM custom resources (iampolicymembers, iampolicies, iampartialpolicies) by non-approved user identities. This could indicate an attempt to gain unauthorized control over cloud IAM policies through the Kubernetes API.
Detects Kubernetes RBAC Role or ClusterRole creation or update events that grant the 'create' verb on Config Connector (KCC) IAM custom resources (iampolicymembers, iampolicies, iampartialpolicies) by non-approved user identities. This could indicate an attempt to gain unauthorized control over cloud IAM policies through the Kubernetes API.
Detects a potential privilege escalation attempt where a namespace-scoped user creates a Config Connector (KCC) IAMPolicyMember resource, which is immediately followed by a high-privilege organization or folder-level SetIamPolicy operation executed by the KCC system service account, suggesting the KCC controller was manipulated to perform actions beyond the namespace's intended authorization.
Detects a potential privilege escalation attempt where a namespace-scoped user creates a Config Connector (KCC) IAMPolicyMember resource, which is immediately followed by a high-privilege organization or folder-level SetIamPolicy operation executed by the KCC system service account, suggesting the KCC controller was manipulated to perform actions beyond the namespace's intended authorization.
Detects a potential privilege escalation attempt where a namespace-scoped user creates a Config Connector (KCC) IAMPolicyMember resource, which is immediately followed by a high-privilege organization or folder-level SetIamPolicy operation executed by the KCC system service account, suggesting the KCC controller was manipulated to perform actions beyond the namespace's intended authorization.
Detects a potential privilege escalation attempt where a namespace-scoped user creates a Config Connector (KCC) IAMPolicyMember resource, which is immediately followed by a high-privilege organization or folder-level SetIamPolicy operation executed by the KCC system service account, suggesting the KCC controller was manipulated to perform actions beyond the namespace's intended authorization.
Detects anomalous process execution patterns involving netkit devices and virtual network interfaces (VXLAN/OVS) configured with oversized headroom, characteristic of the TUNderflow (CVE-2026-81000) exploitation chain. The rule monitors for the staging of netkit devices and specific OVS command-line interactions by non-privileged accounts, excluding known legitimate SDN and CNI infrastructure management processes.
Detects anomalous process execution patterns involving netkit devices and virtual network interfaces (VXLAN/OVS) configured with oversized headroom, characteristic of the TUNderflow (CVE-2026-81000) exploitation chain. The rule monitors for the staging of netkit devices and specific OVS command-line interactions by non-privileged accounts, excluding known legitimate SDN and CNI infrastructure management processes.
Detects anomalous process execution patterns involving netkit devices and virtual network interfaces (VXLAN/OVS) configured with oversized headroom, characteristic of the TUNderflow (CVE-2026-81000) exploitation chain. The rule monitors for the staging of netkit devices and specific OVS command-line interactions by non-privileged accounts, excluding known legitimate SDN and CNI infrastructure management processes.
Detects a potential privilege escalation attempt where a namespace-scoped user creates a Config Connector (KCC) IAMPolicyMember resource, which is immediately followed by a high-privilege organization or folder-level SetIamPolicy operation executed by the KCC system service account, suggesting the KCC controller was manipulated to perform actions beyond the namespace's intended authorization.
Detects anomalous process execution patterns involving netkit devices and virtual network interfaces (VXLAN/OVS) configured with oversized headroom, characteristic of the TUNderflow (CVE-2026-81000) exploitation chain. The rule monitors for the staging of netkit devices and specific OVS command-line interactions by non-privileged accounts, excluding known legitimate SDN and CNI infrastructure management processes.
Detects anomalous process execution patterns involving netkit devices and virtual network interfaces (VXLAN/OVS) configured with oversized headroom, characteristic of the TUNderflow (CVE-2026-81000) exploitation chain. The rule monitors for the staging of netkit devices and specific OVS command-line interactions by non-privileged accounts, excluding known legitimate SDN and CNI infrastructure management processes.
Page 3 of 14