Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
219 detections
Filters
Last updated
All Time
Detection languages
70
57
56
16
8
Contributors
66
43
20
15
12
Categories
115
62
62
51
35
Platforms
182
29
28
21
17
Products / Services
10,650
9,755
6,688
4,418
3,745
MITRE Techniques
74
67
67
66
42
CVEs
2
1
1
1
1
IDS Classtypes
4
2
1
1
IDS Protocols
8
Detects a single external source IP reading secrets and configmaps across multiple Kubernetes namespaces in bulk within a 1-hour window, which may indicate reconnaissance or credential theft.
Detects the deployment or creation of containers (via Docker, Podman, Nerdctl, Crictl, or Kubectl) with elevated risk flags such as privileged mode, host namespace sharing, root mounts, docker socket access, or initiated from web application parent processes.
Detects the creation or modification of Kubernetes RoleBindings or ClusterRoleBindings that grant highly privileged roles (e.g., cluster-admin or wildcard permissions) to a subject. The detection includes behavioral analysis to identify ServiceAccount usage from unusual source IP addresses within a short timeframe, which may indicate account compromise and unauthorized privilege escalation.
This rule detects potential container escape and privilege escalation attempts within a Kubernetes environment by monitoring for the creation of privileged pods, dangerous host mounts (such as /var/run/docker.sock or hostPath root mounts), and the use of escape-oriented utilities like nsenter or chroot, or access to the host's filesystem via /proc/1/root.
Detects a suspicious sequence of events where Kubernetes API resources (namespaces, secrets, configmaps, pods, or nodes) are enumerated, followed by a search query against the Slack API, indicative of a potential reconnaissance phase or sandbox escape attempt.
Detects high-risk administrative actions within a Kubernetes environment, specifically: users executing or attaching to running pods (potential container access), the creation of privileged pods (potential container escape), or modifications to Role-Based Access Control (RBAC) objects such as roles and role bindings which could lead to privilege escalation.
Detects the creation or modification of Kubernetes RoleBindings or ClusterRoleBindings that grant highly privileged roles (e.g., cluster-admin or wildcard permissions) to a subject. The detection includes behavioral analysis to identify ServiceAccount usage from unusual source IP addresses within a short timeframe, which may indicate account compromise and unauthorized privilege escalation.
Detects unauthorized privilege escalation for AI agent identities within an orchestration platform. The rule triggers when an AI agent account receives an IAM role change, API scope grant, or tool permission update that lacks a corresponding human-approval audit event, or occurs shortly after the agent generates logs indicating potential prompt injection or anomalous behavior.
This rule detects potentially malicious activity where an identity performs enumeration of Kubernetes secrets or configmaps and subsequently performs a search action within Slack from the same IP address within a one-hour window. This behavioral pattern is indicative of post-breakout reconnaissance, where a compromised identity or token is used to exfiltrate sensitive cloud configuration data and then perform internal reconnaissance in SaaS collaboration tools to identify further targets or credentials.
Detects the deployment of the CARBONATO botnet's Hermes Agent within containerized environments. The rule identifies specific artifacts such as the 'SOUL.md' persona configuration, 'netd-svc' container references, and indicators of AI-focused credential theft (e.g., searching for OpenAI or Anthropic API keys) orchestrated by the GH0ST AI agent.
Detects the creation or modification of Google Cloud Config Connector (KCC) IAM resources (IAMPolicyMember, IAMPartialPolicy, IAMPolicy) that assign high-privilege roles like 'roles/owner' or 'roles/resourcemanager.organizationAdmin'. This monitors for potential privilege escalation where a low-privilege actor leverages the KCC controller's high-privilege service account to perform unauthorized IAM binding changes on Google Cloud resources.
Detects 'kubectl exec' or 'kubectl attach' requests targeting pods configured with dangerous security contexts (privileged, hostPID, or hostNetwork). The rule filters out known CI/CD service accounts to focus on potentially malicious manual or unauthorized programmatic access, which often serves as a precursor to container breakout or host-level compromise.
This rule detects unauthorized tampering with AI container images within a container registry. It identifies when existing image tags are overwritten by actors outside of authorized CI/CD pipelines, or when production MLOps infrastructure pulls unsigned or invalid container images, potentially indicating a supply chain attack targeting AI model artifacts.
Detects the execution of the CARBONATO malware watchdog process (.docker-network-monitor) which performs container redeployment operations, indicating an active backdoor and persistent threat attempting to restore its presence within a Docker environment after initial cleanup.
Detects reconnaissance and lateral movement activity via kubectl. The rule monitors for the enumeration of Kubernetes secrets or configmaps, and the deployment or application of privileged workloads featuring flags such as hostPath mounts, privileged execution, hostNetwork, or hostPID.
Detects high-privilege IAM roles (roles/owner, roles/resourcemanager.organizationAdmin) being granted at the GCP organization level. This activity is indicative of the ConfigConfusion attack, where a low-privilege user exploits a Kubernetes ConfigConnector (KCC) controller's high-privilege service account to perform unauthorized IAM modifications.
Detects when a namespace-scoped identity creates, updates, or patches AWS or Azure IAM-related custom resources in Kubernetes. This pattern monitors for a 'confused deputy' scenario where a user might attempt to leverage high-privilege cloud operators (like ACK or ASO v2) that operate with a shared high-privilege identity to modify cloud IAM configurations.
Detects when a namespace-scoped identity creates, updates, or patches AWS or Azure IAM-related custom resources in Kubernetes. This pattern monitors for a 'confused deputy' scenario where a user might attempt to leverage high-privilege cloud operators (like ACK or ASO v2) that operate with a shared high-privilege identity to modify cloud IAM configurations.
Detects reconnaissance and lateral movement activity via kubectl. The rule monitors for the enumeration of Kubernetes secrets or configmaps, and the deployment or application of privileged workloads featuring flags such as hostPath mounts, privileged execution, hostNetwork, or hostPID.
Detects when a namespace-scoped identity creates, updates, or patches AWS or Azure IAM-related custom resources in Kubernetes. This pattern monitors for a 'confused deputy' scenario where a user might attempt to leverage high-privilege cloud operators (like ACK or ASO v2) that operate with a shared high-privilege identity to modify cloud IAM configurations.
Detects when a namespace-scoped identity creates, updates, or patches AWS or Azure IAM-related custom resources in Kubernetes. This pattern monitors for a 'confused deputy' scenario where a user might attempt to leverage high-privilege cloud operators (like ACK or ASO v2) that operate with a shared high-privilege identity to modify cloud IAM configurations.
Page 1 of 11