Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
276 detections
Filters
Last updated
All Time
Detection languages
119
62
41
18
11
Contributors
55
47
38
31
18
Categories
165
71
63
63
48
Platforms
39,915
7,245
6,529
3,864
3,627
276
Products / Services
182
37
34
31
25
MITRE Techniques
91
65
61
59
52
CVEs
5
5
5
5
2
IDS Classtypes
4
3
2
2
1
IDS Protocols
11
Detects the creation of Kubernetes pods where the 'hostPID' or 'hostNetwork' settings are enabled. These configurations allow a pod to share the host's process namespace or network stack, respectively, which are common vectors for container escapes and host-level privilege escalation.
Detects anomalous process execution and filesystem access patterns originating from Gitea Act Runner that indicate an attempted container-to-host escape. This includes the injection of dangerous container flags (e.g., --pid=host, --privileged, --cap-add=ALL) into workflow commands, the execution of nsenter, or direct access to the host's filesystem structures (e.g., /host or /proc/1/root).
Detects the creation of Kubernetes pods with dangerous security settings that could lead to container escape or privilege escalation. This includes configurations such as hostNetwork enabled, allowPrivilegeEscalation set to true, or running as root (runAsUser = 0). The rule specifically monitors 'io.k8s.core.v1.pods.create' operations in cloud audit logs.
This rule detects potential container escape attempts utilizing Linux system calls such as 'unshare' or 'clone' with flags indicative of namespace manipulation (CLONE_NEWUSER, CLONE_NEWNET). It also detects the execution of suspected malicious binaries or traffic manipulation tools associated with 'packet_edit_meme' or 'act_pedit' activities, which are common in Linux-based exploitation scenarios.
Detects access to Kubernetes secret objects containing sensitive configuration data
Detects the presence of PIL exception messages in application logs that leak heap memory addresses. This is the first stage of the CVE-2026-22778 exploitation chain against vLLM instances used to bypass ASLR.
Detects access to Kubernetes secret objects containing sensitive configuration data
Detects shell execution inside Docker containers
This rule detects when a child process of npm (node, bun, or npm itself) reads a Kubernetes service account token file. This activity can indicate a compromised package attempting to access internal Kubernetes clusters from a developer's machine. Such an event warrants investigation into recent software installations or user activity, and engagement with the security team if the cause is unclear.
Detects Kubernetes CronJob creation for scheduled malicious execution
Detects upload of backdoored container images to internal registries
Detects Python processes accessing sensitive credential paths, a common post-exploitation step for malicious ML models (e.g., CVE-2026-4372). The rule specifically looks for Python executables accessing paths commonly associated with cloud (AWS) or container (Kubernetes) credentials. It includes exclusions for known legitimate ML pipeline scripts to reduce noise.
Detects attempts to list, read, create, update, or delete Kubernetes secrets via the Kubernetes API server. This activity could indicate an adversary attempting to gain access to sensitive information or manipulate the environment.
This rule detects attempts to deploy a malicious pod via the Kubernetes API. It specifically looks for HTTP POST requests to the '/api/v1/namespaces/' endpoint followed by '/pods', indicating an attempt to create a new pod within a Kubernetes namespace.
This rule detects HTTP requests to the Kubernetes API endpoint '/api/v1/pods' on port 8080. This activity is indicative of an attempt to discover Kubernetes pods and services, which could be part of reconnaissance by an attacker or an authorized user.
Detects the creation or deletion of Kubernetes namespaces and nodes via the API server. This activity can indicate an adversary attempting to establish persistence, expand their control, or disrupt the environment within a Kubernetes cluster.
Detects kubectl exec and port-forward operations via the Kubernetes API server. 'Exec' provides interactive shell access to a running container, while 'Port-forward' tunnels into the pod network, potentially bypassing network policies. This rule also detects 'attach' operations.
Detects the creation of Kubernetes pods with dangerous security settings that could lead to privilege escalation or container escape. This includes configurations such as enabling hostNetwork, allowing privilege escalation within containers, or running containers as the root user (UID 0).
This rule detects attempts to access Kubernetes secret objects via the Kubernetes API. It specifically looks for HTTP requests to the '/api/v1/namespaces/' path followed by '/secrets' on port 8080. This activity could indicate an attacker attempting to exfiltrate sensitive information stored in Kubernetes secrets.
This rule detects attempts to execute commands within a Kubernetes pod using `kubectl exec`. It specifically looks for HTTP requests to port 8080 (often used by Kubernetes API servers or proxies) with URIs containing both '/exec' and 'pods', indicating an interactive command execution session within a pod.
This rule detects attempts to deploy a Kubernetes CronJob via the Kubernetes API. It specifically looks for HTTP requests targeting the '/apis/batch' and 'cronjobs' URI paths, indicating an interaction with the batch API group for CronJob resources. This could be an indicator of an attacker attempting to establish persistence or execute malicious code within the Kubernetes cluster by scheduling tasks.
Page 7 of 14