| elastic |
AWS EKS Privileged Pod Created |
production |
2026-10-21 |
| elastic |
AWS EKS Pod Created with a Sensitive hostPath Volume |
production |
2026-10-21 |
| elastic |
AWS EKS Container Created with Excessive Linux Capabilities |
production |
2026-10-21 |
| elastic |
AWS EKS Pod Created With HostIPC |
production |
2026-10-21 |
| elastic |
AWS EKS Pod Created With HostNetwork |
production |
2026-10-21 |
| elastic |
AWS EKS Pod Created With HostPID |
production |
2026-10-21 |
| elastic |
AWS EKS Ephemeral Container Added to Pod |
production |
2026-10-20 |
| elastic |
AWS EKS API Server Proxying Request to Kubelet |
production |
2026-10-20 |
| elastic |
Potential Container Escape via Kernel core_pattern Modification |
production |
2026-10-09 |
| elastic |
Namespace Manipulation Using Unshare |
production |
2026-10-09 |
| elastic |
Mount Execution Detected via Defend for Containers |
production |
2026-10-08 |
| elastic |
Kubernetes Pod Created With HostNetwork |
production |
2026-10-06 |
| elastic |
Kubernetes Pod Created With HostPID |
production |
2026-10-06 |
| elastic |
Kubernetes Pod Created With HostIPC |
production |
2026-10-06 |
| splunk |
Linux Docker Root Directory Mount |
production |
2026-10-02 |
| elastic |
GKE Privileged Pod Created |
production |
2026-09-18 |
| elastic |
GKE Pod Created with a Sensitive hostPath Volume |
production |
2026-09-18 |
| elastic |
Kubernetes API Server Proxying Request to Kubelet |
production |
2026-09-18 |
| elastic |
Kubernetes Container Created with Excessive Linux Capabilities |
production |
2026-09-18 |
| elastic |
Kubernetes Ephemeral Container Added to Pod |
production |
2026-09-18 |
| elastic |
Kubernetes Pod Created with a Sensitive hostPath Volume |
production |
2026-09-18 |
| elastic |
Kubernetes Privileged Pod Created |
production |
2026-09-18 |
| elastic |
Unusual Process Connection to Docker or Containerd Socket |
production |
2026-09-18 |
| elastic |
Container Runtime CLI Execution with Suspicious Arguments |
production |
2026-09-18 |
| elastic |
Egress Connection from Entrypoint in Container |
production |
2026-09-18 |
| elastic |
Privileged Docker Container Creation |
production |
2026-09-18 |
| elastic |
Pod or Container Creation with Suspicious Command-Line |
production |
2026-09-18 |
| elastic |
Nsenter to PID Namespace via Auditd |
production |
2026-09-18 |
| elastic |
Chroot Execution in Container Context on Linux |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation in Container via Runc Init |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation via Container Misconfiguration |
production |
2026-09-18 |
| elastic |
File System Debugger Launched Inside a Container |
production |
2026-09-18 |
| elastic |
Potential Chroot Container Escape via Mount |
production |
2026-09-18 |
| elastic |
Docker Release File Creation |
production |
2026-09-18 |
| elastic |
Kernel Load or Unload via Kexec Detected |
production |
2026-09-18 |
| elastic |
Mount Launched Inside a Container |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation through Writable Docker Socket |
production |
2026-09-18 |
| elastic |
Potential Docker Escape via Nsenter |
production |
2026-09-18 |
| elastic |
Privileged Container Creation with Host Directory Mount |
production |
2026-09-18 |
| elastic |
Suspicious Container Runtime CLI Execution |
production |
2026-09-18 |
| elastic |
Chroot Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
DebugFS Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Nsenter Execution with Target Flag Inside Container |
production |
2026-09-18 |
| elastic |
Potential notify_on_release Container Escape Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Potential release_agent Container Escape Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Namespace Manipulation Using Unshare in a Container |
production |
2026-09-18 |
| elastic |
GKE API Server Proxying Request to Kubelet |
production |
2026-09-18 |
| elastic |
GKE Ephemeral Container Added to Pod |
production |
2026-09-18 |
| elastic |
GKE Container Created with Excessive Linux Capabilities |
production |
2026-09-18 |
| elastic |
GKE Pod Created With HostIPC |
production |
2026-09-18 |
| elastic |
GKE Pod Created With HostNetwork |
production |
2026-09-18 |
| elastic |
GKE Pod Created With HostPID |
production |
2026-09-18 |
| splunk |
Cisco IOS XE Guestshell Activation and Destroy |
production |
2026-05-20 |
| splunk |
Cisco Isovalent - Potential Escape to Host |
production |
2026-05-13 |
| sigma |
Container With A hostPath Mount Created |
test |
2024-03-26 |
| sigma |
Privileged Container Deployed |
test |
2024-03-26 |