| elastic |
GKE Client Certificate Signing Request Created or Approved |
production |
2026-09-18 |
| elastic |
GKE Certificate Signing Request Self-Approved |
production |
2026-09-18 |
| elastic |
GKE Admission Webhook Created or Modified |
production |
2026-09-18 |
| elastic |
Unusual GCP Event for a User |
production |
2026-09-18 |
| elastic |
Unusual Country For a GCP Event |
production |
2026-09-18 |
| elastic |
Unusual City For a GCP Event |
production |
2026-09-18 |
| elastic |
Nsenter Execution with Target Flag Inside Container |
production |
2026-09-18 |
| elastic |
Mount Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
DebugFS Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Chroot Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Web Server Exploitation Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Suspicious Echo or Printf Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
SSH Authorized Key File Activity Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Modification of Persistence Relevant Files Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Process Killing Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Tool Installation Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Suspicious Interpreter Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
File Execution Permission Modification Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Potential Direct Kubelet Access via Process Arguments Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Payload Execution via Shell Pipe Detected by Defend for Containers |
production |
2026-09-18 |
| elastic |
Netcat File Transfer or Listener Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Potential Kubeletctl Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Interactive Shell Spawn Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
System Path File Creation and Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
File Creation and Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Exec Into Container Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Direct Kubernetes API Request Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Suspicious Container Runtime CLI Execution |
production |
2026-09-18 |
| elastic |
Container Management Utility Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Tool Enumeration Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Suspicious Network Tool Launch Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Service Account Namespace Read Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Privilege Boundary Enumeration Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Potential Cluster Enumeration via jq Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Kubelet Pod Discovery Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Kubelet Certificate File Access Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Environment Variable Enumeration Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
DNS Enumeration Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Encoded Payload Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Dynamic Linker Modification Detected via Defend for Containers |
production |
2026-09-18 |