Browse Rules

Punycode sender domain

The sender's domain contains punycode, a technique used by attackers to impersonate legitimate domains.

Link to a domain with punycode characters

The body contains a link to a domain with Punycode characters to hide the true URL destination, or contains non-printable ASCII content.

AWS GuardDuty DGA Domain Activity Detected

Amazon GuardDuty detects an Amazon EC2 instance or a container querying algorithmically generated domains (DGA).

DNS Enumeration Detected via Defend for Containers

This rule detects the execution of DNS enumeration tools inside a container. DNS enumeration tools are used to enumerate the DNS servers and domains of the container, which can be used by an adversary to gain information about the network configuration of the container and the services running inside it.

Box - New external user

'Detects when new user created with SourceLogin containing non-corporate domain.'

Container Workload Protection

Generates a detection alert each time a 'Container Workload Protection' alert is received. Enabling this rule allows you to immediately begin triaging and investigating these alerts.

WHOIS DNS Query To Typesquatting Domain

Provides example usage of WHOIS data, detecting a DNS query for a domain that contains a specific string and is not registered with the defined domain registrar.

Container Management Utility Execution Detected via Defend for Containers

This rule detects when a container management binary is run from inside a container. These binaries are critical components of many containerized environments, and their presence and execution in unauthorized containers could indicate compromise or a misconfiguration.

Container Management Utility Run Inside A Container

This rule detects when a container management binary is run from inside a container. These binaries are critical components of many containerized environments, and their presence and execution in unauthorized containers could indicate compromise or a misconfiguration.

Process Killing Detected via Defend for Containers

This rule detects the killing of processes inside a container. An adversary may attempt to find and kill competing processes to gain control of the container.

Sensitive File Compression Detected via Defend for Containers

Identifies the use of a compression utility to collect known files containing sensitive information, such as credentials and system configurations inside a container.

Namespace Manipulation Using Unshare in a Container

Identifies suspicious usage of unshare to manipulate system namespaces. Unshare can be utilized to escalate privileges or escape container security boundaries. Threat actors have utilized this binary to allow themselves to escape to the host and access other resources or escalate privileges.

Unusual Process Connection to Docker or Containerd Socket

Detects a process connecting to a container runtime Unix socket (containerd or Docker) that is not a known legitimate runtime component. Direct access to the container runtime socket allows an attacker to create, exec into, or manipulate containers without going through the Kubernetes API server, bypassing RBAC, admission webhooks, pod security standards, and Kubernetes audit logging entirely.

Tool Installation Detected via Defend for Containers

This rule detects the installation of tools inside a container. An adversary may need to install additional software to enumerate the container, its environment, and move laterally within the environment.

Sensitive Files Compression Inside A Container

Identifies the use of a compression utility to collect known files containing sensitive information, such as credentials and system configurations inside a container.

Chroot Execution in Container Context on Linux

Detects chroot execution on Linux when the process appears to run in a container-oriented context: the process title matches runc init, the entry leader is a container workload, or the parent process is runc. Chroot from inside a container can pivot to an alternate root filesystem and is a common step in container breakout attempts when combined with sensitive host mounts.

Suspicious Access to Active Directory Database File

Identifies access to the Active Directory Domain Database file (ntds.dit). This file contains sensitive information including hashed domain credentials.

Potential Privilege Escalation via Container Misconfiguration

This rule monitors for the execution of processes that interact with Linux containers through an interactive shell without root permissions. Utilities such as runc and ctr are universal command-line utilities leveraged to interact with containers via root permissions. On systems where the access to these utilities are misconfigured, attackers might be able to create and run a container that mounts the root folder or spawn a privileged container vulnerable to a container escape attack, which migh

Brand impersonation: Office 365 mail service

Detects messages from domains containing both 'o365' and 'mail' in the second-level domain, commonly used to impersonate legitimate Microsoft Office 365 mail services.

Container Runtime CLI Execution with Suspicious Arguments

Detects execution of container runtime CLI tools (ctr, crictl, nerdctl) with arguments indicating container creation, command execution inside existing containers, image manipulation, or host filesystem mounting. These tools interact directly with the container runtime socket, bypassing the Kubernetes API server, RBAC authorization, admission webhooks, pod security standards, and Kubernetes audit logging entirely. Attackers with host-level access may use these tools to create privileged ghost co

Privileged Docker Container Creation

This rule leverages the new_terms rule type to identify the creation of a potentially unsafe docker container from an unusual parent process. Attackers can use the "--privileged" flag to create containers with escalated privileges, which can lead to trivial privilege escalation, docker escaping and persistence. access.

Link: Multistage landing - ClickUp abuse

Detects ClickUp documents that contain external links to suspicious domains including new domains, free file hosts, URL shorteners, or links that redirect to phishing pages or contain captchas.

Interactive Shell Spawn Detected via Defend for Containers

This rule detects when an interactive shell is spawned inside a running container. This could indicate a potential container breakout attempt or an attacker's attempt to gain unauthorized access to the underlying host.

Privileged Container Creation with Host Directory Mount

This rule detects the creation of privileged containers that mount host directories into the container's filesystem. Such configurations can be exploited by attackers to escape the container isolation and gain access to the host system, potentially leading to privilege escalation and lateral movement within the environment.

Egress Connection from Entrypoint in Container

This rule identifies a sequence of events where a process named "entrypoint.sh" is started in a container, followed by a network connection attempt. This sequence indicates a potential egress connection from an entrypoint in a container. An entrypoint is a command or script specified in the Dockerfile and executed when the container starts. Attackers can use this technique to establish a foothold in the environment, escape from a container to the host, or establish persistence.