| elastic |
AWS EKS Suspicious Self-Subject Review via Unusual User Agent |
production |
2026-10-21 |
| elastic |
AWS EKS Potential Endpoint Permission Enumeration Attempt Detected |
production |
2026-10-21 |
| elastic |
AWS EKS Forbidden Request from Unusual User Agent |
production |
2026-10-21 |
| elastic |
AWS EKS Potential Endpoint Permission Enumeration Attempt by Anonymous User Detected |
production |
2026-10-21 |
| elastic |
AWS EKS Secrets List Across Cluster or Sensitive Namespaces |
production |
2026-10-20 |
| elastic |
AWS EKS API Server Proxying Request to Kubelet |
production |
2026-10-20 |
| elastic |
AWS EKS Multi-Resource Discovery |
production |
2026-10-20 |
| elastic |
Docker Socket Enumeration |
production |
2026-10-09 |
| elastic |
Container Management Utility Execution Detected via Defend for Containers |
production |
2026-10-08 |
| elastic |
Privilege Boundary Enumeration Detected via Defend for Containers |
production |
2026-10-08 |
| elastic |
GKE API Request Failure Burst by User |
production |
2026-09-22 |
| elastic |
DNS Enumeration Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Environment Variable Enumeration Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Kubelet Certificate File Access Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Kubelet Pod Discovery Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Potential Cluster Enumeration via jq Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Service Account Namespace Read Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Tool Enumeration Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Direct Kubernetes API Request Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Potential Kubeletctl Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Potential Direct Kubelet Access via Process Arguments Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
GKE Secrets List from Unusual Source AS Organization |
production |
2026-09-18 |
| elastic |
GKE Anonymous Endpoint Permission Enumeration |
production |
2026-09-18 |
| elastic |
GKE Endpoint Permission Enumeration |
production |
2026-09-18 |
| elastic |
GKE Multi-Resource Discovery |
production |
2026-09-18 |
| elastic |
GKE Suspicious Self-Subject Review via Service Account |
production |
2026-09-18 |
| elastic |
GKE Forbidden Request from Unusual User Agent |
production |
2026-09-18 |
| elastic |
GKE API Server Proxying Request to Kubelet |
production |
2026-09-18 |
| elastic |
Kubernetes Secrets List Across Cluster or Sensitive Namespaces |
production |
2026-09-18 |
| elastic |
Kubernetes Potential Endpoint Permission Enumeration Attempt by Anonymous User Detected |
production |
2026-09-18 |
| elastic |
Kubernetes Potential Endpoint Permission Enumeration Attempt Detected |
production |
2026-09-18 |
| elastic |
Kubernetes Multi-Resource Discovery |
production |
2026-09-18 |
| elastic |
Kubernetes Suspicious Self-Subject Review via Unusual User Agent |
production |
2026-09-18 |
| elastic |
Kubernetes Forbidden Request from Unusual User Agent |
production |
2026-09-18 |
| elastic |
Kubernetes API Server Proxying Request to Kubelet |
production |
2026-09-18 |
| elastic |
GitHub Authentication Token Access via Node.js |
production |
2026-09-18 |
| elastic |
Kubernetes Service Account Secret Access |
production |
2026-09-18 |
| elastic |
Kubeconfig File Discovery |
production |
2026-09-18 |
| elastic |
Potential Kubeletctl Execution |
production |
2026-09-18 |
| elastic |
Unusual Process Connection to Docker or Containerd Socket |
production |
2026-09-18 |
| elastic |
Potential Direct Kubelet Access via Process Arguments |
production |
2026-09-18 |
| elastic |
Kubelet API Connection Attempt to Internal IP |
production |
2026-09-18 |
| elastic |
Container Management Utility Run Inside A Container |
production |
2026-09-18 |
| elastic |
Potential Kubectl Masquerading via Unexpected Process |
production |
2026-09-18 |
| elastic |
Kubectl Permission Discovery |
production |
2026-09-18 |
| elastic |
Kubectl Secrets Enumeration Across All Namespaces |
production |
2026-09-18 |
| elastic |
Direct Interactive Kubernetes API Request by Common Utilities |
production |
2026-09-18 |
| elastic |
Forbidden Direct Interactive Kubernetes API Request |
production |
2026-09-18 |
| elastic |
Direct Interactive Kubernetes API Request by Unusual Utilities |
production |
2026-09-18 |
| elastic |
Service Account Token or Certificate Access Followed by Kubernetes API Request |
production |
2026-09-18 |
| elastic |
Kubernetes Direct API Request via Curl or Wget |
production |
2026-09-18 |
| elastic |
Azure AKS Potential API Enumeration by User |
production |
2026-09-18 |
| elastic |
Azure AKS Suspicious Self-Subject Review by Service Account or Node Identity |
production |
2026-09-18 |
| elastic |
Kubernetes Denied Service Account Request via Unusual User Agent |
deprecated |
2026-08-21 |
| elastic |
Azure AKS Multi-Resource Setup Discovery |
production |
2026-08-04 |
| sigma |
Kubernetes Potential Enumeration Activity |
experimental |
2026-04-28 |