Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
219 detections
Filters
Last updated
All Time
Detection languages
70
57
56
16
8
Contributors
66
43
20
15
12
Categories
115
62
62
51
35
Platforms
182
29
28
21
17
Products / Services
10,660
9,758
6,692
4,418
3,748
MITRE Techniques
74
67
67
66
42
CVEs
2
1
1
1
1
IDS Classtypes
4
2
1
1
IDS Protocols
8
Kubernetes Service Account Token Theft
Cortex XDR
Detects non-legitimate processes attempting to read Kubernetes service account tokens or related sensitive files (ca.crt, namespace) from the standard service account path within containers. This rule filters out common and legitimate Kubernetes system processes to reduce false positives.
Detects the creation of DaemonSets in a Kubernetes cluster using the `kubectl` command-line tool. DaemonSets are designed to run a copy of a Pod on all (or some) nodes in the cluster, making them a powerful mechanism for persistence and cluster-wide credential harvesting by attackers. This rule specifically looks for `kubectl` commands that include 'daemonset' and either 'create' or 'apply' operations.
This rule detects the creation, patching, or updating of Kubernetes ClusterRoleBindings, RoleBindings, or Roles within the 'prod', 'production', or 'default' namespaces. It specifically excludes actions performed by the 'system:clusterrole-aggregation-controller' to reduce noise from legitimate system operations. This activity can indicate an attempt to manipulate access controls within the Kubernetes cluster, potentially for privilege escalation or persistence.
This rule detects the creation, patching, or updating of Kubernetes 'clusterrolebindings', 'rolebindings', or 'roles' within 'prod', 'production', or 'default' namespaces. It specifically excludes actions performed by the 'system:clusterrole-aggregation-controller' to reduce false positives related to legitimate system operations. This activity could indicate an attempt to escalate privileges or establish persistence within critical Kubernetes environments.
Detects when events are deleted in Kubernetes.
An adversary may delete Kubernetes events in an attempt to evade detection.
An adversary may delete Kubernetes events in an attempt to evade detection.
Detects potential Kubernetes enumeration or attack activity via the audit log.
This includes the execution of common shells, utilities, or specialized tools like 'Rakkess' (access_matrix) and 'TruffleHog' via Kubernetes API requests.
Attackers use these methods to perform reconnaissance (enumeration), secret harvesting, or execute code (exec) within a cluster.
This includes the execution of common shells, utilities, or specialized tools like 'Rakkess' (access_matrix) and 'TruffleHog' via Kubernetes API requests.
Attackers use these methods to perform reconnaissance (enumeration), secret harvesting, or execute code (exec) within a cluster.
Detects when a modification (create, update or replace) action is taken that affects mutating or validating webhook configurations, as they can be used by an adversary to achieve persistence or exfiltrate access credentials.
etects the full TeamPCP lateral movement pattern: listing secrets across namespaces followed by privileged alpine pod creation in kube-system. Correlation rule.
Detects deployments of pods within the kube-system namespace, which could be intended to imitate system pods.
System pods, created by controllers such as Deployments or DaemonSets have random suffixes in their names.
Attackers can use this fact and name their backdoor pods as if they were created by these controllers to avoid detection.
Deployment of such a backdoor container e.g. named kube-proxy-bv61v, could be attempted in the kube-system namespace alongside the other administrative containers.
System pods, created by controllers such as Deployments or DaemonSets have random suffixes in their names.
Attackers can use this fact and name their backdoor pods as if they were created by these controllers to avoid detection.
Deployment of such a backdoor container e.g. named kube-proxy-bv61v, could be attempted in the kube-system namespace alongside the other administrative containers.
Detects curl or wget accessing the default Kubernetes service account token path. Adapted from Unit 42 reporting on Slow Pisces and React2Shell (CVE-2025-55182) campaigns.
Detects TCP connections to ports commonly associated with reverse shells,
C2 frameworks, and attacker tooling, as observed by Tetragon eBPF kernel-level
network monitoring. After initial container compromise, attackers establish
outbound connections on non-standard ports to maintain command and control.
Tetragon provides full process context (binary, pod, namespace, parent process)
tied to the network event, enabling high-fidelity correlation.
C2 frameworks, and attacker tooling, as observed by Tetragon eBPF kernel-level
network monitoring. After initial container compromise, attackers establish
outbound connections on non-standard ports to maintain command and control.
Tetragon provides full process context (binary, pod, namespace, parent process)
tied to the network event, enabling high-fidelity correlation.
Detects attempts to access or exfiltrate the default Kubernetes service account token file using web utilities like curl or wget. This activity is commonly observed in attacks by threat actors such as Slow Pisces to escalate privileges or move laterally from a compromised pod into backend cloud infrastructure.
Detects the execution of a 'kubectl get secrets' command with specific parameters ('--all-namespaces', '-o json', '|| true') via a 'bash' process on Linux systems. This activity is indicative of bulk Kubernetes secret enumeration, a technique used by the TeamPCP stealer as described by Microsoft.
Detects the creation of highly privileged Kubernetes pods in the 'kube-system' namespace matching the naming convention 'node-setup-*', indicative of TeamPCP lateral movement techniques. These pods request elevated privileges such as 'hostPID', 'hostNetwork', and 'privileged'.
Detects the execution of `kubectl` commands designed to dump all secrets across all namespaces within a Kubernetes cluster. This activity is indicative of an adversary attempting to gain access to sensitive credentials, as observed in supply chain compromises.
Detects the execution of `kubectl` commands designed to dump all secrets across all namespaces within a Kubernetes cluster. This activity is indicative of an adversary attempting to gain access to sensitive credentials, as observed in supply chain compromises.
Detects interactive shell execution within a container in a production, using 'exec'. The execution of `cat`, followed by network connections. This would be communicating with a service that runs arbitrary commands.
Rule to detect where there are role bindings and high-risk actions (verbs) applied within production or default namespaces. This rule specifically looks for these high-risk actions (verbs), excluding actions by the 'system:clusterrole-aggregation-controller' user, which is a legitimate system process.
Detects the deletion of Kubernetes log events, which could indicate an attempt at defense evasion or covering tracks by an attacker. The rule looks for 'delete' operations on 'Event' resources while excluding actions by 'ci-admin*' or 'system:*' users to reduce false positives.
Detects activity where there are role bindings and high-risk actions (verbs) applied.
This could be indicative of Privilege Escalation.
This could be indicative of Privilege Escalation.
Detects interactive shell execution within a container in a production Kubernetes namespace, using the 'exec' command.
Running this command in a pod allows a user to establish a temporary shell session and execute any process/commands in the pod.
Running this command in a pod allows a user to establish a temporary shell session and execute any process/commands in the pod.
Page 5 of 11