Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
199 detections
Filters
Last updated
All Time
Detection languages
60
48
24
21
13
Contributors
66
40
27
22
15
Categories
140
103
69
34
28
Platforms
148
146
31
20
17
Products / Services
10,651
9,755
6,688
4,418
3,745
MITRE Techniques
87
85
76
45
36
CVEs
7
4
3
2
1
IDS Classtypes
10
7
5
1
1
IDS Protocols
19
5
This rule detects unauthenticated access attempts to the Docker Daemon API, specifically targeting TCP port 2375. It triggers on the initial SYN packet of a TCP connection to this port, indicating an attempt to establish a connection to the Docker API without authentication. This activity is often associated with privilege escalation attempts, as an unauthenticated Docker API can be exploited to gain control over the host system.
This rule detects attempts to enumerate Docker containers via the Docker API by looking for HTTP requests containing the URI '/containers/json'. This activity could indicate an attacker performing reconnaissance on a compromised host to understand the running container environment.
This rule detects the creation of a Docker container via the Docker API (port 2375) where the container body content includes the string "cron" (case-insensitive). This could indicate an attempt to establish persistence or schedule malicious tasks within a Docker environment.
Identifies instances where curl is used to interact with a mounted Docker Unix socket. This technique is used to issue API commands directly to the Docker daemon, often to deploy new privileged containers for host escape.
Docker Run/Exec Guardrails Bypass
Cortex XDR
This rule detects the execution of a Docker command with the '--privileged' flag on a Linux system, combined with the execution of specific system information gathering commands. This combination is often indicative of an attempt to escape a container or gain elevated privileges within a containerized environment, potentially leading to host compromise. The '--privileged' flag grants a container nearly all capabilities of the host machine, making it a critical security concern when used maliciously.
Kubernetes Service Account Token Theft
Cortex XDR
Detects non-legitimate processes attempting to read Kubernetes service account tokens or related sensitive files (ca.crt, namespace) from the standard service account path within containers. This rule filters out common and legitimate Kubernetes system processes to reduce false positives.
This rule detects the execution of common system enumeration commands (lsblk, hostname, mount, uname) within a Docker container, when the container is run with privileged access. This activity could indicate an adversary attempting to glean information about the container environment.
Detects persistence establishment after docker container escape
Detects persistence establishment after docker container escape
Detects scripts designed for container escape and host persistence
Detects privilege escalation attempts used by the Shai-Hulud malware. This includes checking for passwordless sudo ('sudo -n true') and exploiting Docker to modify the 'sudoers.d' file to grant root privileges.
Detects the RedTail cryptominer targeting exposed Docker APIs by looking for specific HTTP request patterns, including the 'libredtail-http' user agent and 'docker.selfrep' parameter in the request body.
The following analytic detects the use of default or publicly known named pipes associated with Cobalt Strike. It leverages Sysmon EventID 17 and 18 to identify specific named pipes commonly used by Cobalt Strike's Artifact Kit and Malleable C2 Profiles. This activity is significant because Cobalt Strike is a popular tool for adversaries to conduct post-exploitation tasks, and identifying its named pipes can reveal potential malicious activity. If confirmed malicious, this could indicate an active Cobalt Strike beacon, leading to unauthorized access, data exfiltration, or further lateral movement within the network.
This analytic detects suspicious data transfer activities involving the use of the `split` syscall with the `-b` option, which specifies the size of each output file. This technique can be used by attackers to evade detection by breaking large files into smaller parts, bypassing size-based security controls, and facilitating covert exfiltration of sensitive data. By monitoring for unusual or unauthorized use of the `split` syscall with a specified block size, this analytic helps identify potential data exfiltration attempts.
This analytic identifies the bulk creation of ransomware notes (e.g., .txt, .html, .hta files) on an infected machine. It leverages Sysmon EventCode 11 to detect multiple instances of these file types being created within a short time frame (10 seconds). A detection is triggered if 15 or more unique readme paths are observed. This activity is a strong indicator of an active ransomware attack, where the attacker is notifying the victim of the encryption. If confirmed malicious, this behavior could lead to widespread data encryption, rendering critical files inaccessible and potentially causing significant operational disruption.
The following analytic detects suspicious attempts to find credentials stored in password stores, indicating a potential attacker's effort to access sensitive login information. Password stores are critical repositories that contain valuable credentials, and unauthorized access to them can lead to significant security breaches. By monitoring for unusual or unauthorized activities related to password store access, this analytic helps identify potential credential theft attempts, allowing security teams to respond promptly and prevent unauthorized access to critical systems and data.
The following analytic identifies the execution of RAR utilities to archive files on a system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, GUIDs, and command-line arguments. This activity is significant as threat actors, including red-teamers and malware like DarkGate, use RAR archiving to compress and exfiltrate collected data from compromised hosts. If confirmed malicious, this behavior could lead to the unauthorized transfer of sensitive information to command and control servers, posing a severe risk to data confidentiality and integrity.
This analytic detects the configuration of TFTP services on Cisco IOS devices that could be used to exfiltrate sensitive configuration files. Threat actors like Static Tundra have been observed configuring TFTP servers to make device configuration files accessible for exfiltration after gaining initial access. The detection specifically looks for commands that expose critical configuration files such as startup-config, running-config, and other sensitive system information through TFTP. This activity is particularly concerning as it may represent an attempt to steal credentials, network topology information, and other sensitive data stored in device configurations.
The analytic detects when a Windows RDP client attempts to execute an RDP file from a temporary directory, downloads directory, or Outlook directories. This detection is significant as it can indicate an attempt for an adversary to deliver a .rdp file, which may be leveraged by attackers to control or exfiltrate data. If confirmed malicious, this activity could lead to unauthorized access, data theft, or further lateral movement within the network.
The analytic identifies the execution of the native mimikatz.exe binary on Windows systems, including instances where the binary is renamed. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and original file names. This activity is significant because Mimikatz is a widely used tool for extracting authentication credentials, posing a severe security risk. If confirmed malicious, this activity could allow attackers to obtain sensitive credentials, escalate privileges, and move laterally within the network, leading to potential data breaches and system compromise.
This analytic detects new UDP communication between a source and destination workload pair within a Kubernetes cluster. It uses Network Performance Monitoring (NPM) metrics from an OTEL collector via Splunk Observability Cloud. The detection compares network activity over the last hour with the past 30 days to identify new inter-workload communication. Such changes in network behavior can indicate potential security threats or anomalies, including unauthorized connections that may lead to data breaches, privilege escalation, lateral movement, or disruption of critical services.
Page 8 of 10