Analytics Informational
✕

Suspicious container reconnaissance activity in a Kubernetes pod

A process performed multiple consecutive container discovery commands from within a Kubernetes Pod.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Discovery (TA0007)
ATT&CK techniques: Remote System Discovery (T1018) System Information Discovery (T1082) System Network Configuration Discovery (T1016) System Service Discovery (T1007) Container and Resource Discovery (T1613)
Detector tags: Kubernetes - AGENT Containers
Attacker's goals:

Collect information about the host, network and user configuration for lateral movement and privilege escalation.

Investigative actions:

Verify if the script or process initiating the discovery commands is benign. Verify that this isn't sanctioned IT activity. Look for other hosts executing similar commands.

Test period:
10 Minutes
Deduplication:
1 Day
2 variations:
  • Suspicious container reconnaissance activity in a Kubernetes pod Medium (parent: Informational)
  • Suspicious container reconnaissance activity in a Kubernetes pod Low (parent: Informational)