Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
276 detections
Filters
Last updated
All Time
Detection languages
119
62
41
18
11
Contributors
55
47
38
31
18
Categories
165
71
63
63
48
Platforms
39,915
7,245
6,529
3,864
3,627
276
Products / Services
182
37
34
31
25
MITRE Techniques
91
65
61
59
52
CVEs
5
5
5
5
2
IDS Classtypes
4
3
2
2
1
IDS Protocols
11
Detects the creation or modification of Kubernetes ClusterRoles, ClusterRoleBindings, and RoleBindings, which can be used for privilege escalation within a Kubernetes cluster. The rule specifically flags activities related to 'cluster-admin' roles as critical and other administrative roles as high severity.
This rule detects attempts to enumerate Kubernetes namespaces by looking for HTTP requests to the '/api/v1/namespaces' endpoint on port 8080. This activity could indicate an attacker attempting to discover available namespaces within a Kubernetes cluster.
Detects activity where one K8s client accesses many secrets in a short span.
This could be indicative of Credential access, working towards Privilege Escalation.
This could be indicative of Credential access, working towards Privilege Escalation.
This rule detects the creation of a cluster role binding in a Kubernetes environment, specifically looking for HTTP POST requests to the Kubernetes API server's rbac.authorization.k8s.io endpoint for 'rolebindings'. This activity can indicate an attempt to establish persistence within the cluster by granting specific permissions to an identity.
Detects ServiceAccount-based enumeration of sensitive Kubernetes resources. This rule identifies when a Kubernetes ServiceAccount performs a high volume of 'get', 'list', or 'watch' operations on sensitive resources such as secrets, pods, nodes, namespaces, or other role-related resources. It specifically flags activity with 'secrets' as high severity.
Detects deletion of Kubernetes events in audit logs when the request completes successfully.
Adversaries may delete events to impair defenses and cover tracks (defense evasion).
Adversaries may delete events to impair defenses and cover tracks (defense evasion).
Detects suspicious Kubernetes Role-Based Access Control (RBAC) changes that grant elevated privileges, such as 'cluster-admin' roles, wildcard permissions for verbs, resources, or API groups, or direct access to secrets or service accounts. This rule monitors 'create', 'update', and 'patch' operations on roles, clusterroles, rolebindings, and clusterrolebindings within Kubernetes audit logs.
Detects interactive shell execution within a container in a production, using 'exec'. The execution of `cat`, followed by network connections. This could be communicating with a service that runs arbitrary commands.
Identifies the use of curl to send POST requests to the Kubernetes API targeting the creation of pods. This can indicate an attacker using a stolen ServiceAccount token to deploy malicious or privileged containers.
Identifies the use of the nsenter utility targeting PID 1 to spawn a shell. This is a common container escape technique used to break out of a privileged container and execute commands on the underlying host.
Detects workloads created with privileged mode, host namespace sharing, dangerous Linux capabilities, Docker socket, containerd socket, or sensitive hostPath mounts. These configurations can be abused by adversaries to escape containers and gain access to the underlying host.
Correlation rule that counts the events produced by Kubernetes Audit Event Deletion base rule
Detects Mini Shai-Hulud supply-chain malware (router_init.js / router_runtime.js / tanstack_runner.js)
This suite of rules detects various activities associated with the Mini Shai-Hulud npm worm, including the execution of its payload via bun, network connections to its exfiltration domain, attempts by Node.js or Bun processes to access AWS IMDS for credential theft, access to local HashiCorp Vault instances, identification of known malicious script file hashes, and the installation of its specific malicious GitHub dependency.
Detects Mini Shai-Hulud supply-chain malware (router_init.js / router_runtime.js / tanstack_runner.js)
Kubernetes Service Account Token Theft
Cortex XDR
Detects non-legitimate processes attempting to read Kubernetes service account tokens or related sensitive files (ca.crt, namespace) from the standard service account path within containers. This rule filters out common and legitimate Kubernetes system processes to reduce false positives.
Detects the creation of DaemonSets in a Kubernetes cluster using the `kubectl` command-line tool. DaemonSets are designed to run a copy of a Pod on all (or some) nodes in the cluster, making them a powerful mechanism for persistence and cluster-wide credential harvesting by attackers. This rule specifically looks for `kubectl` commands that include 'daemonset' and either 'create' or 'apply' operations.
This rule detects the creation, patching, or updating of Kubernetes ClusterRoleBindings, RoleBindings, or Roles within the 'prod', 'production', or 'default' namespaces. It specifically excludes actions performed by the 'system:clusterrole-aggregation-controller' to reduce noise from legitimate system operations. This activity can indicate an attempt to manipulate access controls within the Kubernetes cluster, potentially for privilege escalation or persistence.
This rule detects the creation, patching, or updating of Kubernetes 'clusterrolebindings', 'rolebindings', or 'roles' within 'prod', 'production', or 'default' namespaces. It specifically excludes actions performed by the 'system:clusterrole-aggregation-controller' to reduce false positives related to legitimate system operations. This activity could indicate an attempt to escalate privileges or establish persistence within critical Kubernetes environments.
Detects when events are deleted in Kubernetes.
An adversary may delete Kubernetes events in an attempt to evade detection.
An adversary may delete Kubernetes events in an attempt to evade detection.
Detects potential Kubernetes enumeration or attack activity via the audit log.
This includes the execution of common shells, utilities, or specialized tools like 'Rakkess' (access_matrix) and 'TruffleHog' via Kubernetes API requests.
Attackers use these methods to perform reconnaissance (enumeration), secret harvesting, or execute code (exec) within a cluster.
This includes the execution of common shells, utilities, or specialized tools like 'Rakkess' (access_matrix) and 'TruffleHog' via Kubernetes API requests.
Attackers use these methods to perform reconnaissance (enumeration), secret harvesting, or execute code (exec) within a cluster.
Page 8 of 14