Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
276 detections
Filters
Last updated
All Time
Detection languages
119
62
41
18
11
Contributors
55
47
38
31
18
Categories
165
71
63
63
48
Platforms
39,916
7,245
6,529
3,864
3,627
276
Products / Services
182
37
34
31
25
MITRE Techniques
91
65
61
59
52
CVEs
5
5
5
5
2
IDS Classtypes
4
3
2
2
1
IDS Protocols
11
Detects the creation or update of LiteLLM custom code guardrails that include suspicious Python snippets, specifically 'import os' and 'os.popen', which are indicative of attempts to execute arbitrary OS commands via guardrail logic (CVE-2026-59821).
Detects the creation or update of LiteLLM custom code guardrails that include suspicious Python snippets, specifically 'import os' and 'os.popen', which are indicative of attempts to execute arbitrary OS commands via guardrail logic (CVE-2026-59821).
Detects unauthorized attempts to manipulate cgroup files (e.g., cgroup.procs) within Kubernetes pods using kubectl exec/attach sessions. This technique is often associated with SPIRE attestation spoofing or container escape attempts where an attacker attempts to influence process management or isolation constraints from within the container via the Kubernetes API.
Detects unauthorized attempts to manipulate cgroup files (e.g., cgroup.procs) within Kubernetes pods using kubectl exec/attach sessions. This technique is often associated with SPIRE attestation spoofing or container escape attempts where an attacker attempts to influence process management or isolation constraints from within the container via the Kubernetes API.
Detects unauthorized attempts to manipulate cgroup files (e.g., cgroup.procs) within Kubernetes pods using kubectl exec/attach sessions. This technique is often associated with SPIRE attestation spoofing or container escape attempts where an attacker attempts to influence process management or isolation constraints from within the container via the Kubernetes API.
Detects successful authentication attempts to a LiteLLM proxy instance using the hardcoded default master key 'sk-1234'. This activity indicates potential exploitation of misconfigured instances where default credentials remain unchanged.
Detects successful authentication attempts to a LiteLLM proxy instance using the hardcoded default master key 'sk-1234'. This activity indicates potential exploitation of misconfigured instances where default credentials remain unchanged.
Detects successful authentication attempts to a LiteLLM proxy instance using the hardcoded default master key 'sk-1234'. This activity indicates potential exploitation of misconfigured instances where default credentials remain unchanged.
Detects attempts by non-privileged (non-PROXY_ADMIN) API keys to modify pass-through routes in LiteLLM via configuration update endpoints. This activity is indicative of exploitation of CVE-2026-35029, which allows unauthenticated or low-privilege users to bypass configuration restrictions.
This rule detects successful attempts by non-approved users or service accounts to delete, patch, or update Kubernetes PrometheusRule or AlertmanagerConfig resources. These resources control critical cluster monitoring and alerting; unauthorized changes could be used to disable security monitoring, modify alert notification channels to hide malicious activity, or tamper with detection capabilities.
This rule detects suspicious outbound network connections from common container runtime processes (e.g., containerd.exe, dockerd.exe) to well-known cloud instance metadata services (169.254.169.254, 100.100.100.200) or suspicious attempts to access container image manifests, which are indicative of SSRF attacks, credential theft from the metadata API, or potential container escape attempts.
This rule detects suspicious outbound network connections from common container runtime processes (e.g., containerd.exe, dockerd.exe) to well-known cloud instance metadata services (169.254.169.254, 100.100.100.200) or suspicious attempts to access container image manifests, which are indicative of SSRF attacks, credential theft from the metadata API, or potential container escape attempts.
This rule detects potential attempts to exploit kernel vulnerabilities related to the Stream Control Transmission Protocol (SCTP) within a containerized environment, followed by suspicious file creation activity in sensitive system directories (e.g., /root/). It correlates logs showing SCTP socket configuration activity with subsequent filesystem modifications within a short 5-minute window.
A GitHub maintainer account related to the keyv/cacheable npm package ecosystem was compromised. The attacker published malicious versions of these packages, which affected more than 400 npm packages. The malware is designed to steal cloud credentials, developer secrets, CI/CD secrets, AI tool configuration files, and cryptocurrency wallet data. It also creates persistence using Claude Code hooks and VS Code tasks.json files, and sends stolen data to attacker-controlled GitHub repositories and C2 domains.
Reference article: https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack
Reference article: https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack
Detects credential and token harvesting behaviors associated with the ChainDrop/Shai-Hulud 2.0 npm worm, specifically targeting CI/CD environments. The rule monitors for unauthorized access to /proc/[pid]/mem to scrape memory for workflow secrets, extraction of OIDC environment variables, and suspicious invocation of the GitHub CLI (gh) to steal authentication tokens.
This rule detects potential attempts to exploit kernel vulnerabilities related to the Stream Control Transmission Protocol (SCTP) within a containerized environment, followed by suspicious file creation activity in sensitive system directories (e.g., /root/). It correlates logs showing SCTP socket configuration activity with subsequent filesystem modifications within a short 5-minute window.
Detects Python worker processes (e.g., dataset converters) spawning suspicious child processes (shells, network tools) or accessing sensitive filesystem paths/endpoints, such as Kubernetes service account tokens or cloud instance metadata, which are often indicative of post-exploitation activity following an SSTI or code injection vulnerability.
Detects file access/read of the in-cluster Kubernetes service account token path or a user's kubeconfig file by a non-standard binary (e.g. scripting interpreter, shell, or network utility) rather than known Kubernetes/orchestration tooling. Narrowed to reduce false positives from legitimate kubectl, helm, kubelet, and container runtime processes that routinely read these credentials.
This rule detects unauthorized or suspicious access attempts to a MinIO storage service by monitoring network traffic for default credentials, specific API calls like 'ListBuckets', or access to sensitive paths like 'terraform-state'. It triggers when traffic either targets the 'minio.internal' hostname or the local loopback address on port 9000, specifically looking for common MinIO administrative indicators.
Detects unauthorized attempts by low-privileged API tokens to access sensitive Argo CD endpoints related to Git repository credentials and project configurations. This rule specifically monitors for exploitation patterns associated with CVE-2025-55190, where tokens with read-only access could retrieve secrets they are not authorized to view.
Detects instances where the Argo CD repo-server or kustomize processes spawn unexpected child processes, such as shells or network utilities. This behavior is indicative of potential command injection, specifically concerning the unauthenticated GenerateManifest gRPC service vulnerability (CVE-2024-31989), where an attacker could execute arbitrary code on the underlying host or container.
Page 5 of 14