security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
70d7f2b6b1b3b8fbfce1d549e21a84ecef48ba87
sigma-rules/rules/integrations/cloud_defend
T
History
shashank-elastic 70d7f2b6b1 Monthly Manifest and Schema Updation (#5697)
2026-02-10 09:17:04 +05:30
..
command_and_control_curl_socks_proxy_detected_inside_container.toml
Add investigation guides (#5630)
2026-01-27 14:28:06 +05:30
command_and_control_interactive_file_download_from_internet.toml
[New/Tuning] Misc. New D4C Rules and Tunings (#5692)
2026-02-09 16:58:27 +01:00
container_workload_protection.toml
[New Rules] Reintroduction of Defend for Containers (D4C) Ruleset (#5561)
2026-01-26 16:37:34 +01:00
credential_access_cloud_creds_search_inside_a_container.toml
[New Rules] Reintroduction of Defend for Containers (D4C) Ruleset (#5561)
2026-01-26 16:37:34 +01:00
credential_access_collection_sensitive_files_compression_inside_a_container.toml
[New Rules] Reintroduction of Defend for Containers (D4C) Ruleset (#5561)
2026-01-26 16:37:34 +01:00
credential_access_sensitive_keys_or_passwords_search_inside_a_container.toml
[New Rules] Reintroduction of Defend for Containers (D4C) Ruleset (#5561)
2026-01-26 16:37:34 +01:00
credential_access_service_account_token_or_cert_read.toml
[New/Tuning] Misc. New D4C Rules and Tunings (#5692)
2026-02-09 16:58:27 +01:00
defense_evasion_deletion_of_shell_cmdline_history.toml
[New/Tuning] Misc. New D4C Rules and Tunings (#5692)
2026-02-09 16:58:27 +01:00
defense_evasion_interactive_process_execution_from_suspicious_directory.toml
[New/Tuning] Misc. New D4C Rules and Tunings (#5692)
2026-02-09 16:58:27 +01:00
defense_evasion_ld_preload_shared_object_modified_inside_a_container.toml
[New Rules] Reintroduction of Defend for Containers (D4C) Ruleset (#5561)
2026-01-26 16:37:34 +01:00
defense_evasion_potential_evasion_via_encoded_payload.toml
[New/Tuning] Misc. New D4C Rules and Tunings (#5692)
2026-02-09 16:58:27 +01:00
discovery_dns_enumeration.toml
Add investigation guides (#5630)
2026-01-27 14:28:06 +05:30
discovery_environment_enumeration.toml
Add investigation guides (#5630)
2026-01-27 14:28:06 +05:30
discovery_kubelet_certificate_file_access.toml
Monthly Manifest and Schema Updation (#5697)
2026-02-10 09:17:04 +05:30
discovery_kubelet_pod_discovery_via_builtin_utilities.toml
[New/Tuning] Misc. New D4C Rules and Tunings (#5692)
2026-02-09 16:58:27 +01:00
discovery_potential_cluster_enumeration_via_jq.toml
[New Rules] Misc. D4C Rules re: (un)Authenticated API Access (#5661)
2026-02-04 09:58:42 +01:00
discovery_privilege_boundary_enumeration_from_interactive_process.toml
[New/Tuning] Misc. New D4C Rules and Tunings (#5692)
2026-02-09 16:58:27 +01:00
discovery_service_account_namespace_read.toml
[New/Tuning] Misc. New D4C Rules and Tunings (#5692)
2026-02-09 16:58:27 +01:00
discovery_suspicious_network_tool_launched_inside_a_container.toml
[New Rules] Reintroduction of Defend for Containers (D4C) Ruleset (#5561)
2026-01-26 16:37:34 +01:00
discovery_tool_enumeration.toml
Add investigation guides (#5630)
2026-01-27 14:28:06 +05:30
execution_container_management_binary_launched_inside_a_container.toml
[New Rules] Reintroduction of Defend for Containers (D4C) Ruleset (#5561)
2026-01-26 16:37:34 +01:00
execution_direct_interactive_kubernetes_api_request.toml
Add investigation guides (#5630)
2026-01-27 14:28:06 +05:30
execution_interactive_exec_to_container.toml
[New Rules] Reintroduction of Defend for Containers (D4C) Ruleset (#5561)
2026-01-26 16:37:34 +01:00
execution_interactive_file_creation_followed_by_execution.toml
[New/Tuning] Misc. New D4C Rules and Tunings (#5692)
2026-02-09 16:58:27 +01:00
execution_interactive_file_creation_in_system_binary_locations.toml
[New/Tuning] Misc. New D4C Rules and Tunings (#5692)
2026-02-09 16:58:27 +01:00
execution_interactive_shell_spawned_from_inside_a_container.toml
[New Rules] Reintroduction of Defend for Containers (D4C) Ruleset (#5561)
2026-01-26 16:37:34 +01:00
execution_kubeletctl_execution.toml
Monthly Manifest and Schema Updation (#5697)
2026-02-10 09:17:04 +05:30
execution_netcat_listener_established_inside_a_container.toml
[New Rules] Reintroduction of Defend for Containers (D4C) Ruleset (#5561)
2026-01-26 16:37:34 +01:00
execution_potential_direct_kubelet_access_via_process_args.toml
Monthly Manifest and Schema Updation (#5697)
2026-02-10 09:17:04 +05:30
execution_suspicious_file_made_executable_via_chmod_inside_a_container.toml
[New Rules] Reintroduction of Defend for Containers (D4C) Ruleset (#5561)
2026-01-26 16:37:34 +01:00
execution_suspicious_interactive_interpreter_command_execution.toml
[New/Tuning] Misc. New D4C Rules and Tunings (#5692)
2026-02-09 16:58:27 +01:00
execution_tool_installation.toml
[New/Tuning] Misc. New D4C Rules and Tunings (#5692)
2026-02-09 16:58:27 +01:00
persistence_ssh_authorized_keys_modification_inside_a_container.toml
[New Rules] Reintroduction of Defend for Containers (D4C) Ruleset (#5561)
2026-01-26 16:37:34 +01:00
persistence_suspicious_webserver_child_process_execution.toml
[New/Tuning] Misc. New D4C Rules and Tunings (#5692)
2026-02-09 16:58:27 +01:00
privilege_escalation_debugfs_launched_inside_a_privileged_container.toml
[New Rules] Reintroduction of Defend for Containers (D4C) Ruleset (#5561)
2026-01-26 16:37:34 +01:00
privilege_escalation_mount_launched_inside_a_privileged_container.toml
[New Rules] Reintroduction of Defend for Containers (D4C) Ruleset (#5561)
2026-01-26 16:37:34 +01:00
privilege_escalation_potential_container_escape_via_modified_notify_on_release_file.toml
[New Rules] Reintroduction of Defend for Containers (D4C) Ruleset (#5561)
2026-01-26 16:37:34 +01:00
privilege_escalation_potential_container_escape_via_modified_release_agent_file.toml
[New Rules] Reintroduction of Defend for Containers (D4C) Ruleset (#5561)
2026-01-26 16:37:34 +01:00