OOTB Rules

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください

Datadog provides out-of-the-box (OOTB) detection rules to flag attacker techniques and potential misconfigurations so you can immediately take steps to remediate. Datadog continuously develops new default rules, which are automatically imported into your account, your Application Security Management library, and the Agent, depending on your configuration.

Datadog's Security Research team continuously adds new OOTB security detection rules. While the aim is to deliver high-quality detections with the release of integrations or other new features, the performance of these detections at scale often needs to be observed before making the rule generally available. These rules contain a Beta tag. This gives Datadog's Security Research team time to either refine or deprecate detection opportunities that do not meet Datadog's standards.

Click the following buttons to filter the detection rules. Security detection rules are available for Application Security Management, Cloud SIEM (log detection and signal correlation), CSM Misconfigurations (cloud and infrastructure), CSM Threats, CSM Identity Risks, and Attack Paths.

Cloud Workload Security
>
cloud workload security AppArmor profile modified
cloud workload security Auditd configuration modified
cloud workload security Cloud credentials accessed by network utility
cloud workload security Compiler executed in container
cloud workload security Compiler wrote suspicious file
cloud workload security Container accessed using kubectl in another container
cloud workload security Container breakout attempt using Docker socket
cloud workload security Container breakout using runc file descriptors
cloud workload security Container management utility in container
cloud workload security Crypto miner environment variables observed
cloud workload security Crypto miner process observed
cloud workload security Cryptocurrency miner attempted to boost CPU performance
cloud workload security Database process spawned shell
cloud workload security Dirty Pipe exploitation attempted
cloud workload security DNS lookup for cryptocurrency mining pool
cloud workload security DNS lookup for IP lookup service
cloud workload security DNS lookup for paste service
cloud workload security Dynamic linker hijacking attempt
cloud workload security Evidence hidden by deleting system log file
cloud workload security Executable bit added to newly created file
cloud workload security Exfiltration attempt via network utility
cloud workload security File created and executed inside container
cloud workload security Hash of known malware detected
cloud workload security Interactive shell spawned in container
cloud workload security Kubernetes DNS enumeration
cloud workload security Kubernetes service account token created in container
cloud workload security Local account password modified
cloud workload security Looney Tunables (CVE-2023-4911) exploited for privilege escalation
cloud workload security Memfd object created
cloud workload security Network scanning utility executed
cloud workload security Network utility executed
cloud workload security Network utility executed in container
cloud workload security Network utility executed with suspicious URI
cloud workload security Offensive Kubernetes tool executed
cloud workload security Package installed in container
cloud workload security Post compromise shell detected
cloud workload security Potential rootkit compiled and then loaded
cloud workload security Process hidden using mount
cloud workload security Process injected into another process
cloud workload security PTRACE_TRACEME used to prevent process debugging
cloud workload security Pwnkit privilege escalation attempt
cloud workload security Python executed with suspicious arguments
cloud workload security Recently written or modified suid file has been executed
cloud workload security Redis modified cron job directory to execute commands
cloud workload security Redis sandbox escape (CVE-2022-0543)
cloud workload security Redis server wrote suspicious module file
cloud workload security Resource enumerated using kubectl in container
cloud workload security Resource provisioned using kubectl in container
cloud workload security Runc binary modified
cloud workload security Sensitive namespace modified using kubectl
cloud workload security Shell process created by Java application
cloud workload security Unfamiliar kernel module loaded
cloud workload security Unfamiliar kernel module loaded from memory
cloud workload security Unfamiliar process accessed AWS EKS service account token
cloud workload security Unfamiliar process accessed Kubernetes pod service account token
cloud workload security Unfamiliar process created by web application
cloud workload security User created interactively
Workload Security Monitoring
>
PREVIEWING: brett.blue/embedded-collector-release
Your Privacy Choices