Product
Suspicious Web Server Child Process Execution via Elastic Defend for Containers
2 rules 3 TTPsThis rule detects the exploitation of a web server through the execution of a suspicious process by common web server user accounts within a containerized environment, potentially indicating the uploading of a web shell to maintain system access, and covers persistence, execution, and command and control tactics.
Suspicious Container Runtime CLI Execution
3 rules 2 TTPsThe rule detects execution of container runtime CLI tools (ctr, crictl, nerdctl) with arguments indicating container creation, command execution inside existing containers, image manipulation, or host filesystem mounting, potentially leading to container escape and privilege escalation.
Suspicious Unshare Usage for Container Escape and Privilege Escalation
2 rules 2 TTPsThe rule identifies suspicious usage of unshare to manipulate system namespaces, which can be utilized to escalate privileges or escape container security boundaries.