Analytics BIOC Low
✕

Unusual Process Spawned by Nginx in Ingress-Nginx pod

Unusual Process Spawned by Nginx in Ingress-Nginx pod.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Execution (TA0002) Initial Access (TA0001)
ATT&CK techniques: Command and Scripting Interpreter (T1059) Exploit Public-Facing Application (T1190)
Detector tags: Kubernetes - AGENT Containers
Attacker's goals:

An attacker attempts to use nginx for lateral movement or privilege escalation.

Investigative actions:

Investigate the child processes for malicious activity and network connections to an external host.

Test period:
N/A (single event)
Deduplication:
1 Day
1 variation:
  • Unusual process spawned by ingress-nginx with a critical-severity vulnerability found the workload High (parent: Low)