containers:other
Other container sources (registry, osquery, proxy)
- Host type
- Container runtimes (Docker, containerd)
- Techniques
- 2
- Rules listed
- 67
- Events
- 0
Techniques
Rules
Elastic 67
- Chroot Execution Detected via Defend for Containers
- Cloud Credential Search Detected via Defend for Containers
- Container Management Utility Execution Detected via Defend for Containers
- Container Workload Protection
- Curl SOCKS Proxy Detected via Defend for Containers
- DNS Enumeration Detected via Defend for Containers
- DebugFS Execution Detected via Defend for Containers
- Decoded Payload Piped to Interpreter Detected via Defend for Containers
- Direct Interactive Kubernetes API Request by Common Utilities
- Direct Interactive Kubernetes API Request by Unusual Utilities
- Direct Kubernetes API Request Detected via Defend for Containers
- Docker Socket Enumeration
- Dynamic Linker Modification Detected via Defend for Containers
- Encoded Payload Detected via Defend for Containers
- Environment Variable Enumeration Detected via Defend for Containers
- Exec Into Container Detected via Defend for Containers
- File Creation and Execution Detected via Defend for Containers
- File Download Detected via Defend for Containers
- File Execution Permission Modification Detected via Defend for Containers
- Forbidden Direct Interactive Kubernetes API Request
- Ingress Tool Transfer Followed by Execution and Deletion Detected via Defend for Containers
- Interactive Shell Spawn Detected via Defend for Containers
- Kubeconfig File Creation or Modification
- Kubeconfig File Discovery
- Kubectl Apply Pod from URL
- Kubectl Configuration Discovery
- Kubectl Network Configuration Modification
- Kubectl Permission Discovery
- Kubectl Secrets Enumeration Across All Namespaces
- Kubectl Workload and Cluster Discovery
- Kubelet Certificate File Access Detected via Defend for Containers
- Kubelet Pod Discovery Detected via Defend for Containers
- Kubernetes Direct API Request via Curl or Wget
- Kubernetes Sensitive Configuration File Activity
- Modification of Persistence Relevant Files Detected via Defend for Containers
- Mount Execution Detected via Defend for Containers
- Namespace Manipulation Using Unshare in a Container
- Netcat File Transfer or Listener Detected via Defend for Containers
- Nsenter Execution with Target Flag Inside Container
- Payload Execution via Shell Pipe Detected by Defend for Containers
- Potential Cluster Enumeration via jq Detected via Defend for Containers
- Potential Container Escape via Kernel core_pattern Modification
- Potential Direct Kubelet Access via Process Arguments Detected via Defend for Containers
- Potential Impersonation Attempt via Kubectl
- Potential Kubectl Masquerading via Unexpected Process
- Potential Kubeletctl Execution Detected via Defend for Containers
- Potential notify_on_release Container Escape Detected via Defend for Containers
- Potential release_agent Container Escape Detected via Defend for Containers
- Privilege Boundary Enumeration Detected via Defend for Containers
- Process Killing Detected via Defend for Containers
- SSH Authorized Key File Activity Detected via Defend for Containers
- Sensitive File Compression Detected via Defend for Containers
- Sensitive Keys Or Passwords Search Detected via Defend for Containers
- Service Account Namespace Read Detected via Defend for Containers
- Service Account Token or Certificate Access Followed by Kubernetes API Request
- Service Account Token or Certificate Read Detected via Defend for Containers
- Shell Command-Line History Deletion Detected via Defend for Containers
- Suspicious Container Runtime CLI Execution
- Suspicious Echo or Printf Execution Detected via Defend for Containers
- Suspicious Interpreter Execution Detected via Defend for Containers
- Suspicious Network Tool Launch Detected via Defend for Containers
- Suspicious Process Execution Detected via Defend for Containers
- System Path File Creation and Execution Detected via Defend for Containers
- Tool Enumeration Detected via Defend for Containers
- Tool Installation Detected via Defend for Containers
- Tunneling and/or Port Forwarding Detected via Defend for Containers
- Web Server Exploitation Detected via Defend for Containers
Events
No event-level rows: this source is tiered as a whole.