Product
Sensitive File Compression Detected in Linux Containers for Credential Access
3 rules 8 TTPs 1 IOCElastic Defend for Containers detects the use of compression utilities like tar or zip within Linux containers to collect sensitive files such as SSH keys, AWS credentials, or system configurations, indicating potential credential access and data collection attempts by adversaries.
Potential Direct Kubelet Access via Process Arguments
2 rules 3 TTPsDetection of potential direct Kubelet access via process arguments in Linux containers, which could lead to enumeration, execution, or lateral movement within the Kubernetes cluster.
Nsenter Execution with Target Flag Inside Container
2 rules 1 TTPThe rule detects nsenter executions from inside a monitored Linux container that include a namespace target flag (-t or --target), which can be abused to escape container isolation.
Kubeletctl Execution Inside Container Detected
3 rules 3 TTPsThis rule detects the execution of kubeletctl inside a container, which can be used to enumerate the Kubelet API or other resources inside the container, potentially indicating lateral movement attempts within the pod.