| elastic |
AWS EKS User Exec into Pod |
production |
2026-10-21 |
| elastic |
AWS EKS Ephemeral Container Added to Pod |
production |
2026-10-20 |
| elastic |
AWS EKS Pod Exec Potential Reverse Shell |
production |
2026-10-20 |
| elastic |
AWS EKS Pod Exec Cloud Instance Metadata Access |
production |
2026-10-20 |
| elastic |
AWS EKS Pod Exec Sensitive File or Credential Path Access |
production |
2026-10-20 |
| elastic |
AWS EKS Pod Exec with Curl or Wget to HTTPS |
production |
2026-10-20 |
| elastic |
Docker Socket Enumeration |
production |
2026-10-09 |
| elastic |
Exec Into Container Detected via Defend for Containers |
production |
2026-10-08 |
| elastic |
Container Management Utility Execution Detected via Defend for Containers |
production |
2026-10-08 |
| elastic |
Kubernetes Pod Exec Potential Reverse Shell |
production |
2026-09-22 |
| elastic |
Kubernetes Pod Exec Cloud Instance Metadata Access |
production |
2026-09-22 |
| elastic |
Kubernetes Pod Exec Sensitive File or Credential Path Access |
production |
2026-09-22 |
| elastic |
Kubernetes Pod Exec with Curl or Wget to HTTPS |
production |
2026-09-22 |
| elastic |
GKE Pod Exec Cloud Instance Metadata Access |
production |
2026-09-18 |
| elastic |
GKE Pod Exec Sensitive File or Credential Path Access |
production |
2026-09-18 |
| elastic |
GKE Pod Exec with Curl or Wget to HTTPS |
production |
2026-09-18 |
| elastic |
GKE Pod Exec Potential Reverse Shell |
production |
2026-09-18 |
| elastic |
GKE User Exec into Pod |
production |
2026-09-18 |
| elastic |
GKE Ephemeral Container Added to Pod |
production |
2026-09-18 |
| elastic |
Kubernetes User Exec into Pod |
production |
2026-09-18 |
| elastic |
Kubernetes Ephemeral Container Added to Pod |
production |
2026-09-18 |
| elastic |
Potential Kubeletctl Execution |
production |
2026-09-18 |
| elastic |
Container Management Utility Run Inside A Container |
production |
2026-09-18 |
| elastic |
Container Runtime CLI Execution with Suspicious Arguments |
production |
2026-09-18 |
| elastic |
Privileged Docker Container Creation |
production |
2026-09-18 |
| elastic |
Pod or Container Creation with Suspicious Command-Line |
production |
2026-09-18 |
| elastic |
Kubectl Apply Pod from URL |
production |
2026-09-18 |
| elastic |
Potential Kubectl Masquerading via Unexpected Process |
production |
2026-09-18 |
| elastic |
Direct Interactive Kubernetes API Request by Common Utilities |
production |
2026-09-18 |
| elastic |
Forbidden Direct Interactive Kubernetes API Request |
production |
2026-09-18 |
| elastic |
Direct Interactive Kubernetes API Request by Unusual Utilities |
production |
2026-09-18 |
| elastic |
Privileged Container Creation with Host Directory Mount |
production |
2026-09-18 |
| elastic |
Azure AKS Kubelet Proxy to Command Execution Endpoint |
production |
2026-09-18 |
| elastic |
Azure AKS Pod Exec Potential Reverse Shell |
production |
2026-09-18 |
| elastic |
Azure AKS Attempted User Exec into Pod |
production |
2026-09-18 |
| elastic |
Azure AKS API Server Proxying Request to Kubelet |
production |
2026-09-18 |
| elastic |
Suspicious Container Runtime CLI Execution |
production |
2026-09-18 |
| elastic |
Direct Kubernetes API Request Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Potential Kubeletctl Execution Detected via Defend for Containers |
production |
2026-09-18 |
| sigma |
Kubernetes Potential Enumeration Activity |
experimental |
2026-04-28 |
| sigma |
Potential Remote Command Execution In Pod Container |
test |
2024-03-26 |
| sigma |
Potential Sidecar Injection Into Running Deployment |
test |
2024-03-26 |