Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters. tactic: TA0002 ✕ technique: T1609 ✕

Download CSV Show ATT&CK heatmap
  • Suspicious container runtime connection from within a Kubernetes Pod Informational 2 variations

    A process from within a Kubernetes Pod communicated with the container runtime daemon using the runtime socket. This may indicate an adversary attempting to escape from the Kubernetes Pod to the host.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    5 Days
    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Container Administration Command (T1609) Deploy Container (T1610)
    Required data: XDR Agent
    Detector tags: Kubernetes - AGENT, Containers
    Attacker's goals: Escape from a container to the host machine and expand the foothold in the network.
    Investigative actions: Change the container socket configuration. Check if the default Docker daemon binding to TCP changed. If so, non-root users may gain access to the container.

    Variations

    Suspicious container runtime connection from within a Kubernetes Pod using the curl client

    Low overridden

    A process from within a Kubernetes Pod communicated with the container runtime daemon using the runtime socket. This may indicate an adversary attempting to escape from the Kubernetes Pod to the host. overridden

    Suspicious container runtime connection from within a Kubernetes Pod using the docker client

    Medium overridden

    A process from within a Kubernetes Pod communicated with the container runtime daemon using the runtime socket. This may indicate an adversary attempting to escape from the Kubernetes Pod to the host. overridden