BIOC
Informational
✕
Container enumeration
An attacker may run a command to enumerate containers on a machine.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Discovery
- Status:
- Enabled
ATT&CK tactics: Discovery (TA0007)
ATT&CK techniques: Virtualization/Sandbox Evasion (T1497)
Indicator:
Process action type = execution AND target process name = docker , lxc , rkt AND target process cmd =~ ls(\s+|$)|list(\s+|$)
Preventable: yes