Views:

Policies define the rules that are used to control what is allowed to run in your Kubernetes cluster. You will define one policy for each cluster that you want to protect, with a default set of rules (also known as a "policy definition") that apply to the entire cluster. If your cluster contains more than one namespace, you can also define separate sets of rules for the namespaces. Any namespace rules take precedence over the cluster-wide rules.

For more information, visit the Help Center article, Defining a policy for a cluster.

Exceptions:

When your architecture demands executing containers with privileges, you can create policies based on specific namespaces. This way you can manage it without exposing all your environment to too broad rules.

Recommendations:

Deployment Phase Possible Actions:

  • Log
  • Block
Action Deployment Phase
Pod properties
Log containers that run in the host network namespace
Log containers that run in the host IPC namespace
Log containers that run in the host PID namespace
Container properties
Block containers that are permitted to run as root
Block privileged containers
Block containers with privilege escalation rights
Block containers that can write to the root filesystem
Block containers with capabilities that do not conform with a baseline policy
Image properties
Log images from registries not on an approved allowlist
Log images by name pattern
Log images by registry path
Log images using mutable tags (e.g., :latest)
Vulnerability scanning
Log images not scanned for vulnerabilities in the last 14 days 
Log images with vulnerabilities at or above High+ (CVSS ≥ 7.0)
Malware scanning
Log images not scanned for malware in the last 7 days 
Block images in which malware is detected
Secrets scanning
Log images not scanned for secrets in the last 30 days 
Block images in which secrets are detected
Kubectl access
Log kubectl exec/attach into running containers (consider prod vs. non-prod split)
Log kubectl port-forward usage
Image signature verification
Block images that fail signature verification

Continuous Phase Possible Actions:

  • Log
  • Isolate
  • Terminate
Action Continuous Phase
Pod properties
Log containers that run in the host network namespace
Log containers that run in the host IPC namespace
Log containers that run in the host PID namespace
Container properties
Terminate containers that are permitted to run as root
Terminate privileged containers
Terminate containers with privilege escalation rights
Isolate containers that can write to the root filesystem
Isolate containers with capabilities that do not conform with a baseline policy
Cluster properties
Log changes to RBAC (Role-Based Access Control) configuration
Image properties
Log images from registries not on an approved allowlist
Log images by name pattern
Log images using mutable tags (e.g., :latest)
Log images by registry path

Runtime security provides visibility into container activity that violates a customizable set of rules. Currently, runtime security includes a set of pre-defined rules that provide visibility into MITRE ATT&CK framework tactics for containers, as well as container drift detection. Container Security can automatically mitigate problems detected by the runtime security feature. If a pod violates any rule during runtime, the issue is mitigated by terminating or isolating the pod based on the ruleset assigned to its Container Security policy.

This feature is compatible with Kubernetes and supports Amazon EKS, Microsoft Azure AKS, Google GKE, and OpenShift. It is currently supported with default and the most recent Linux kernels. For more information, visit the Help Center article, Configuring runtime security.

 
Whatever rules are set to terminate/isolate should be first tested via “log”. Terminate/isolate is suggested for PROD environments only, because it can disrupt development or testing.
 

Mitre Attack Container Matrix

Most rules are mapped to Mitre Attack Techniques for Containers.

Runtime Possible Actions

  • Log
  • Isolate
  • Terminate
 

The recommended ruleset provides a baseline and should be tailored to your environment. If a rule generates excessive or irrelevant events, consider disabling it to reduce event noise and unnecessary CPU and memory usage while maintaining meaningful security detections.

ID Rule Description Enable Action RD Resource
TM-00000001 (T1546.004)Modify Shell Configuration File Detect attempt to modify shell configuration files X Log MITRE T1546.004
TM-00000002 (T1505)Update Package Repository Detect package repositories get updated X Log MITRE T1505
TM-00000003 (T1555)Read ssh information Any attempt to read files below ssh directories by non-ssh programs X Log MITRE T1555
TM-00000004 (T1555)Read sensitive file trusted after startup Attempt to read any sensitive file by a trusted program after startup. Trusted programs might read these files at startup but not afterwards. X Log MITRE T1555
TM-00000005 (T1059.004)System user interactive An attempt to run interactive commands by a system (i.e. non-login) user X Log MITRE T1059.004
TM-00000006 (T1609)Terminal shell in container A shell was used as the entrypoint/exec point into a container with an attached terminal. X Log MITRE T1609
TM-00000007 (T1071)System procs network activity Network activity performed by system binaries that are not expected to send or receive any network traffic X Log MITRE T1071
TM-00000008 (T1552.005)Contact EC2 Instance Metadata Service From Container Detect attempts to contact the EC2 Instance Metadata Service from a container X Log MITRE T1552.005
TM-00000010 (T1072)Launch Package Management Process in Container Package management process ran inside container X Log MITRE T1072
TM-00000011 (T1059.004)Netcat Remote Code Execution in Container Netcat Program runs inside the container that allows remote code execution X Log MITRE T1059.004
TM-00000012 (T1685.006)Clear Log Activities Detect modification or removal of critical log files X Log MITRE T1685.006
TM-00000013 (T1555)Create Symlink Over Sensitive Files Detect symlink created over sensitive files X Log MITRE T1555
TM-00000014 (T1557.002)Packet socket created in container Detect new packet socket at the device driver (OSI L2) in a container. Packet socket could be used for ARP Spoofing and privilege escalation(CVE-2020-14386) by attacker. X Log CVE-2020-14386
TM-00000015 (T1059)Redirect STDOUT/STDIN to Network Connection in Container Detect redirecting stdout/stdin to network connection in container (potential reverse shell). X Log MITRE T1059
TM-00000016 (T1547.006)Linux Kernel Module Injection Detected Detect kernel module was injected (from container). X Log MITRE T1547.006
TM-00000017 (T1548.003)Sudo Potential Privilege Escalation Privilege escalation vulnerability affecting sudo (<= 1.9.5p2). Executing sudo using sudoedit -s or sudoedit -i command with command-line argument that ends with a single backslash character from an unprivileged user it's possible to elevate the user privileges to root. X Terminate CVE-2021-3156
TM-00000018 (T1105)Launch Remote File Copy Tools in Container Detect remote file copy tools launched in container X Log MITRE T1105
TM-00000019 (T1613)Specific discovery tool executed in container Detect execution of specific discovery and/or hacking tools inside container X Log MITRE T1613
TM-00000021 (T1685)Disable Security Tools Detect an attempt to disable specific security tools X Terminate MITRE T1685
TM-00000022 (T1609)Docker or kubernetes client executed in container Detect a docker or kubernetes client tool executed inside a container X Log MITRE T1609
TM-00000023 (T1611)Escape attempt detected in privileged container Detect usage of debugfs and mount in container X Log MITRE T1611
TM-00000024 (T1496)HugePages changed in container Detect HugePages modification as part of mining changes done during XMRig usage X Log MITRE T1496
TM-00000025 (T1496)Detect crypto miners using the Stratum protocol Miners typically specify the mining pool to connect to with a URI that begins with 'stratum+tcp' and variants X Terminate MITRE T1496
TM-00000026 (T1053.003)Schedule Cron Jobs Detect cron jobs scheduled X Log MITRE T1053.003
TM-00000027 (T1574.006)Dynamic linker changed Changes to /etc/ld.so.preload may indicate rootkit X Log MITRE T1574.006
TM-00000028 (T1059)DB program spawned process DB related program spawned a new process other than itself. Can indicate successfull SQL injection. X Log MITRE T1059
TM-00000029 (T1021.004)Lateral Movement using SSH SSH execution with StrictHostKeyChecking and BatchMode. Can indicate scripted lateral movement attempt. X Log MITRE T1021.004
TM-00000030 (T1496)Detect miner termination in container Miners typically kill other competeting miners. X Terminate MITRE T1496
TM-00000031 (T1610)Launch Privileged Container Detect the initial process started in a privileged container. X Log MITRE T1610
TM-00000032 (T1070.003)Delete or rename shell history Detect shell history deletion X Log MITRE T1070.003
TM-00000033 (T1222.002)File attributes changed in container Detect an attempt to change attributes on file in container X Log MITRE T1222.002
TM-00000034 (T1548.001)Set Setuid or Setgid bit When the setuid or setgid bits are set for an application this means that the application will run with the privileges of the owning user or group respectively. X Log MITRE T1548.001
TM-00000035 (T1070.004)Dangerous deletion detected in container Detect an attempt to destroy everything X Log MITRE T1070.004
TM-00000039 (T1071)Interpreted procs inbound network activity Any inbound network activity performed by any interpreted program (perl, python, ruby, etc.) - Log MITRE T1071
TM-00000040 (T1071)Interpreted procs outbound network activity Any outbound network activity performed by any interpreted program (perl, python, ruby, etc.) X Log MITRE T1071
TM-00000041 (T1552.004)Search Private Keys or Passwords Detect grep for private keys or passwords also includes find command. X Log MITRE T1552.004
TM-00000042 (T1685)Unexpected process termination in container Detect an attempt get specific processes and kill them often seen as part of miners deployment and rivals termination. X Log MITRE T1685
TM-00000047 (T1685.006)Suspicious log manipulation Detect targeted modification of critical log files X Log MITRE T1685.006
TM-00000048 (T1611)Switch Linux namespace Unauthorized usage of setns syscalls which could lead to container escape X Log MITRE T1611
TM-00000049 (T1105)Launch Ingress Remote File Copy Tools in Container Detect ingress remote file copy tools launched in container X Log MITRE T1105
TM-00000050 (T1059.004)Execution from /dev/shm Detect file execution from the /dev/shm directory a common tactic for threat actors to stash their files. X Log MITRE T1059.004
TM-00000051 (T1552.001)Find AWS Credentials Detect usage of find or grep trying to access AWS credentials. X Log MITRE T1552.001
TM-00000052 (T1055.008)PTRACE attached to process Detect attempts to inject code into a process using PTRACE. X Log MITRE T1055.008
TM-00000053 (T1564.001)Create Hidden Files or Directories Detect hidden files or directories created - Log MITRE T1564.001
TM-00000054 (T1222.002)Mkdir binary dirs Attempt to create a directory below a set of binary directories. X Log MITRE T1222.002
TM-00000055 (T1222.002)Modify binary dirs Attempt to modify any file below a set of binary directories. X Log MITRE T1222.002
TM-00000056 (T1068)Polkit Local Privilege Escalation Attempt to exploit a privilege escalation vulnerability in Polkit's pkexec X Log CVE-2021-4034
TM-00000057 (T1505)Write below rpm database Attempt to write to the rpm database by any non-rpm related program X Log MITRE T1505
TM-00000058 (T1496)Increase Resource Limits via Prlimit Command in Container The prlimit command sets or reports the limits of system-wide resources. X Log MITRE T1496
TM-00000059 (T1136.001)A Local User Added in Container User account creation detected in container. X Log MITRE T1136.001
TM-00000060 (T1098)A Local User Deleted in Container User account deletion detected in container. X Log MITRE T1098
TM-00000061 (T1685)Write to Selinux Config Detect an attempt to write content to the /etc/selinux/config file X Log MITRE T1685
TM-00000062 (T1053.002)Create Scheduled Task Using At At utility used to perform task scheduling for initial or recurring execution of code. X Log MITRE T1053.002
TM-00000063 (T1053.006)Create Scheduled Task Using Systemd Timers Systemd timers used to perform task scheduling for initial or recurring execution of code. X Log MITRE T1053.006
TM-00000064 (T1685)Write to System Control Detect an attempt to write content to the /etc/sysctl.conf file X Log MITRE T1685
TM-00000065 (T1211)Unprivileged Delegation of Page Faults Handling to a Userspace Process Detect a successful unprivileged userfaultfd syscall which might act as an attack primitive to exploit other bugs. X Terminate MITRE T1211
TM-00000069 (T1059)Launch Suspicious Network Tool in Container Detect network tools launched in a container.  X Log TeamTNT (TrendAI)
TM-00000074 (T1083)Read environment variable from /proc files Retrieve the environment variables stored in the relevant /proc files. - Log Falco community rules
TM-00000076 (T1543)Create files below dev File creation below /dev exception for known programs. X Log Falco community rules
TM-00000081 (T1059.004)Offensive tool executed in container Detect execution of specific offensive tools inside container. X Log MITRE T1059.004
TM-00000083 (T1620)File Executed from Memory Detect reflective code load into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process X Log MITRE T1620
TM-00000084 (T1055.009)Inject File to Process Memory Virtual Space Adversaries may inject malicious code into processes via the /proc filesystem in order to evade process-based defenses as well as possibly elevate privileges. Proc memory injection is a method of executing arbitrary code in the address space of a separate live process. X Log MITRE T1055.009
TM-00000085 (T1611)Container Escape via release_agent File Identifies a potential container escape via the cgroup release_agent notification mechanism. Adversaries abuse this to execute arbitrary commands on the host with root privileges, breaking out of the container boundary. X Terminate Falco community rules
TM-00000087 (T1622)PTRACE anti-debug attempt PTRACE system call used with the PTRACE_TRACEME argument. Can indicate attempt to avoid a debugger. X Log Falco community rules
TM-00000088 (T1611)Namespace change using unshare in container Unshare can be used to create a new process namespace and launch malicious process within that namespace. X Log MITRE T1611
TM-00000089 (T1203)Suspicious Directory Change via ProcFD Process attempts to change its working directory using a proc-based file descriptor. Possible CVE-2024-21626 indicator. X Log CVE-2024-21626
TM-00000090 (T1649)Add system certificates Attempt to add new certificates or keys. X Log MITRE T1649
TM-00000091 (T1059.004)Create Hardlink Over Sensitive Files Detect Hardlink created over sensitive files.  X Log Falco community rules
TM-00000093 (T1083) Grep Search on Shell Configuration File Detect an attempt to search a shell configuration file. X Log MITRE T1083
TM-00000096 (T1195.001)Vulnerable liblzma loaded into sshd Possible CVE-2024-3094 exploitation via the SSH daemon loading a vulnerable liblzma library. X Log CVE-2024-3094
TM-00000098 (T1555)Directory Traversal File Read Detect traversal within /etc and /root/.ssh directories. X Log MITRE T1555
TM-00000103 (T1059.006)Python Reading Credential Files in Container Detects Python processes reading known credential file paths inside a container. A Python process systematically reading credential files is a strong indicator of automated credential harvesting tools. X Log LiteLLM supply-chain compromise (TrendAI)
TM-00000104 (T1552.001)Application Credential Files Read in Container Detects reading of application-level credential files (database passwords, API tokens, service credentials) inside a container. These files often contain plaintext credentials for databases, package registries, and messaging services. X Log LiteLLM supply-chain compromise (TrendAI)
TM-00000105 (T1552.001)Cloud Credential Files Read in Container Detects reading of cloud provider credential files (AWS, Azure, GCP) inside a container. May indicate credential harvesting for lateral movement to cloud services. X Log LiteLLM supply-chain compromise (TrendAI)
TM-00000106 (T1552.001)Docker Config Read in Container Detects reading of Docker configuration files containing registry authentication tokens. Attacker with these can push/pull images from private registries. X Log LiteLLM supply-chain compromise (TrendAI)
TM-00000107 (T1528)Kubernetes Credential Files Read in Container Detects reading of Kubernetes cluster configuration files such as admin.conf or controller-manager.conf from inside a container, which may indicate credential harvesting for privilege escalation. X Log MITRE T1528
TM-00000108 (T1552.003)Shell History Files Read in Container Detects reading of shell and CLI history files inside a container. History files may contain previously typed passwords, tokens, and connection strings. X Log LiteLLM supply-chain compromise (TrendAI)
TM-00000109 (T1059.007)Node Process Executing Nohup Detects Node.js spawning nohup to background a process inside a container. Attackers use nohup to maintain persistence of malicious processes (C2 callbacks, miners, backdoors) even after the parent Node.js process exits. X Log MITRE T1059.007
TM-00000110 (T1059.007)NPM PostInstall Spawning Network Tools Detects npm postinstall scripts spawning network download tools inside a container. Supply chain attacks commonly abuse postinstall hooks to download and execute malicious payloads during package installation. X Terminate MITRE T1059.007
TM-00000111 (T1105)Suspicious Script Created in Temp Directory Detects creation of script files in temporary directories inside a container. Attackers commonly drop payloads to /tmp or /dev/shm before execution. X Log MITRE T1105
TM-00000112 (T1055)Process Memory File Access Detect direct access to another process's memory or state via the /proc filesystem (e.g., /proc/[pid]/mem, maps, smaps, pagemap, environ), including per-thread paths under /proc/[pid]/task/[tid]/. Indicates potential process injection, credential extraction, or memory-layout reconnaissance. - Log MITRE T1055
TM-00000113 (T1003)Kernel Memory Direct Access Detect attempts to read kernel memory through interfaces such as /proc/kcore, /dev/mem, or /dev/kmem. Often used for credential extraction or rootkit installation. - Log MITRE T1003
TM-00000114 (T1057)Possible Cross Process Discovery Detect when a process accesses another process's state information via /proc (status, stat, statm, io, limits, mountinfo, cgroup), including per-thread paths under /proc/[pid]/task/[tid]/. Indicates reconnaissance or process discovery activity. - Log MITRE T1057
TM-00000115 (T1003.007)Memory Dump Creation Detect creation of process memory dumps (.dmp, .dump, .core, .mdmp files) or modification of /proc/[pid]/coredump_filter. May indicate credential extraction via memory dumping. X Log MITRE T1003.007
TM-00000118 (T1041)TOR Network Usage Detection Detects TOR network usage through torsocks commands or SOCKS5 proxy connections to .onion domains. X Terminate MITRE T1041
TM-00000119 (T1505.003)Web Process Spawning Shell Detects web services directly spawning shells, which may indicate a webshell or successful remote code execution via a web application. X Log Falco community rules
TM-00000120 (T1068)Setuid Binary Page Cache Manipulation Detects splice() syscall on a setuid binary by an unprivileged process. Core page-cache overwrite primitive used in CVE-2026-31431. X Terminate CVE-2026-31431
TM-00000121 (T1685)Disable SELinux at Runtime Detect runtime SELinux mode change via write to /sys/fs/selinux/enforce or /sys/fs/selinux/disable, a technique used to disable mandatory access control and evade defenses. X Terminate MITRE T1685
TM-00000123 (T1552.001)Cryptocurrency Configuration and Wallet File Read in Container Detects reading of cryptocurrency wallet files, node configs, and signing keys inside a container. Covers major chains (BTC, ETH, SOL, XMR, ADA, etc.) and matches credential theft patterns from supply-chain attacks. X Log MITRE T1552.001
TM-00000124 (T1543.002)Install Systemd Unit for Persistence Detects writing a systemd unit file to a system or user-level unit directory inside a container. Attackers install systemd units to persist across reboots, often disguised as legitimate services. X Log MITRE T1543.002
TM-00000125 (T1552.001)DevOps Secrets and Environment Files Read in Container Detects suspicious processes (shells, file-view tools, search tools, network download tools) reading environment files, IaC secrets, or CI/CD configuration files inside a container. Matches credential harvesting behavior observed in supply-chain attacks against AI/ML Python packages (e.g., LiteLLM compromise). X Log MITRE T1552.001
TM-00000126 (T1552.001)Sensitive Developer and Host Credential Files Read in Container Detects reading of host SSH private keys, Terraform credentials and variable files, and AI tool configuration files inside a container. These files often contain plaintext secrets, API tokens, or infrastructure credentials used for lateral movement and privilege escalation. X Log MITRE T1552.001
TM-00000127 (T1074.001)Archive Operation in Writable Staging Directory Detects archive or compression tools operating on files in commonly writable directories inside a container. Attackers stage and compress stolen credentials or collected data in world-writable directories before exfiltration. X Log node-ipc sabotage (Snyk)
TM-00000128 (T1003.008)System Account and Authentication Log File Read in Container Detects reading of system password hash database or authentication logs inside a container. Commonly observed in post-exploitation scripts harvesting password hashes or login records for lateral movement. X Log MITRE T1003.008
TM-00000129 (T1552.004)TLS Private Key and Certificate File Read in Container Detects reading of private key or certificate files inside a container. Commonly observed in post-exploitation scripts harvesting TLS material for impersonation or lateral movement. X Log MITRE T1552.004
TM-00000130 (T1105)Binary Execution From Temporary Directory via Python Interpreter Detects execution of a binary located under a temporary directory spawned by a Python interpreter inside a container. This pattern is commonly observed in dropper scripts that download a payload, make it executable, and detach it from the parent interpreter for persistence or post-exploitation. X Terminate LiteLLM supply-chain compromise (TrendAI)
TM-00000131 (T1055)Page Reference Bits Cleared via clear_refs Detects clearing of page reference bits for another process, a technique used in memory-access side-channel attacks and abnormal process introspection. X Log MITRE T1055
TM-00000132 (T1611)Core Dump Pattern Modified Detects modification of the kernel core dump handler configuration, a well-known container-escape primitive that can execute arbitrary code with host-level privileges. X Terminate MITRE T1611
TM-00000133 (T1057)Cross-Process Binary Read via Proc Exe Detects cross-process binary image reads, useful for binary exfiltration or workload fingerprinting in shared PID namespaces. X Log MITRE T1057
TM-00000134 (T1622)Debugger Executed in Container Detects execution of process debuggers inside containers. Workload containers normally do not run debuggers; their presence indicates process inspection, anti-debug evasion, or hands-on-keyboard activity. X Log MITRE T1622
TM-00000135 (T1055)Cross-Process FD Theft via pidfd_getfd Detects cross-process file descriptor theft via kernel syscall, bypassing traditional proc filesystem access. Can expose sockets, secret files, or stdio of sibling workloads. X Log Falco community rules
TM-00000136 (T1685)YAMA Ptrace_scope Tampered Detects tampering with the kernel ptrace security scope, commonly used as a precursor to credential dumping or process injection. X Log MITRE T1685
TM-00000137 (T1082)Debugfs Kernel Structure Read Detects reads of kernel debug filesystem contents from within a container. This interface exposes kernel-internal structures normally restricted to privileged contexts; reads indicate kernel reconnaissance or exploitation setup. X Log MITRE T1082
TM-00000138 (T1003.001)Existing Core Dump Read Detects reads of existing process core or crash dump files from within a container. Core dumps can contain credentials and secrets from a crashed process's memory; this complements dump-creation detection by catching consumption. X Log MITRE T1003.001
TM-00000139 (T1055)kcmp Cross-process Resource Comparison Detects use of the kcmp syscall, which compares whether two processes share kernel resources (file descriptors, virtual memory, file system). Rare in legitimate workloads; used to fingerprint or select process injection targets. Note - kcmp arguments are not decoded by the driver, so the compared PIDs are not available in the alert output. X Log MITRE T1055
TM-00000140 (T1057)Cross-process Security Context Read Detects reads of /proc/[pid]/attr/current (including per-thread task/[tid]/ paths) for a process other than self, disclosing the SELinux or AppArmor security context of a sibling process. Used for sandbox/confinement reconnaissance prior to escape attempts. X Log MITRE T1057
TM-00000141 (T1546)AI Tool and IDE Config Persistence Hook Write in Container Detects writes to AI coding tool and IDE configuration files in a container. Attackers use these files as cross-session persistence hooks that re-execute payloads on every new session. X Log Shai-Hulud npm worm (TrendAI)
TM-00000142 (T1059.007)NPM Install Spawning Interpreter Detects a scripting interpreter spawned by a JavaScript package manager install in a container. Malicious packages abuse lifecycle hooks to launch alternative runtimes that bypass Node.js-only endpoint instrumentation. X Log Shai-Hulud npm worm (TrendAI)
TM-00000143 (T1609)Container Lateral Movement via kubectl exec from Interpreter Detects a scripting interpreter or shell inside a container invoking kubectl exec to run commands in another pod. This pattern is characteristic of automated lateral movement in container worms, where a compromised workload pod programmatically pivots to neighboring pods. X Log Shai-Hulud npm worm (TrendAI)
TM-00000144 (T1059.006)PyPI Install Spawning Interpreter Detects a non-Python scripting interpreter or network download tool spawned by a Python package manager install in a container. Malicious PyPI packages abuse setup.py and post-install hooks to launch alternative runtimes or fetch second-stage payloads during installation. X Log Shai-Hulud npm worm (TrendAI)
TM-00000145 (T1222.002)Failed Modification of Binary Directories Detects failed attempts to rename or remove files in system binary directories due to permission errors. Probing of these paths is commonly associated with reconnaissance for defense evasion or privilege escalation via binary replacement. X Log MITRE T1222.002
TM-00000146 (T1222)Failed Permission Change on Sensitive Files Detects failed chmod or chown invocations targeting sensitive system files or binary directories inside a container due to permission errors. Probing of these paths is commonly associated with reconnaissance for permission manipulation during defense evasion or privilege escalation activity. X Log MITRE T1222
TM-00000147 (T1548)Failed Privilege Elevation via setuid or setgid Detects failed setuid or setgid syscall invocations inside a container due to permission errors. Unprivileged processes attempting to switch identity to root or another user are commonly associated with privilege escalation attempts. X Log MITRE T1548
TM-00000148 (T1053.003)Failed Write to Cron Configuration Detects failed write attempts to cron job configuration files or directories inside a container due to permission errors. Probing of these paths is commonly associated with reconnaissance for persistence via scheduled task abuse. X Log MITRE T1053.003
TM-00000149 (T1685.006)Failed Write to System Log Directory Detects failed write attempts to system log files or directories inside a container due to permission errors. Probing of these paths is commonly associated with reconnaissance for log tampering or evidence removal during defense evasion activity. X Log MITRE T1685.006
TM-00000150 (T1505)Failed Write to RPM Database Detects failed write attempts to the RPM package database inside a container due to permission errors. Unauthorized processes probing this path may indicate reconnaissance associated with persistence via package manager abuse. X Log MITRE T1505
TM-00000151 (T1098.004)Failed Write to SSH Configuration Detects failed write attempts to SSH configuration files or authorized key paths inside a container due to permission errors. Probing of these paths is commonly associated with reconnaissance for persistence via remote access manipulation. X Log MITRE T1098.004
TM-00000152 (T1098)Failed Write to System Account Files Detects failed write attempts to system account and authentication configuration files inside a container due to permission errors. Probing of these paths is commonly associated with reconnaissance for privilege escalation or persistence via account manipulation. X Log MITRE T1098
TM-00000153 (T1055)Cross-process Memory Access via process_vm Detects the process_vm_readv and process_vm_writev syscalls, which read from or write to another process's address space directly, bypassing /proc/[pid]/mem. Used for credential extraction (readv) or code injection (writev) across the inter-process isolation boundary. X Log MITRE T1055
TM-00000154 (T1057)Cross-Process File Descriptor Metadata Read Detects a process reading the open file descriptor metadata of another process, exposing the files, sockets, and pipes a sibling workload holds open along with their offsets and flags. Used to map another process's resources during reconnaissance. X Log MITRE T1057
TM-00000155 (T1057)Cross-Process Namespace Handle Read Detects a process reading another process's namespace handles, revealing the identity of its PID, network, mount, or user namespaces. This enumeration is reconnaissance that typically precedes a namespace-join container escape. X Log MITRE T1057
TM-00000156 (T1685)io_uring Instance Setup in Container Detects creation of an io_uring asynchronous I/O instance inside a container. io_uring performs file and network operations through a shared submission queue without issuing the corresponding syscalls, so a workload can read sensitive files or another process's memory while evading syscall-based runtime detection. Rare in most container workloads; some databases and async runtimes use it legitimately, so tune with an allowlist if noisy. X Log MITRE T1685
TM-00000158 (T1529)Suspicious Reboot Syscall Activity Detect reboot syscall which should never be called from within a container. X Terminate MITRE T1529
TM-00000159 (T1611)Unusual Swap Operations Activity Detect swap-related syscalls that should not occur in containers.  X Log MITRE T1611
TM-00000160 (T1552.005)Contact ECS Task Metadata Endpoint From Container Detects a shell or interpreter spawning a process that contacts the ECS task metadata endpoint (169.254.170.2) to retrieve task IAM role credentials. This pattern is used by credential-harvesting payloads such as Mini Shai-Hulud and may indicate cloud credential theft. X Log MITRE T1552.005
TM-00000161 (T1611)Kernel Keyring Manipulation in Container Detects use of the Linux kernel keyring management interface from within a container. Container workloads rarely interact with the kernel keyring; such activity may indicate an attempt to abuse keyring-based privilege escalation or container-escape primitives. X Log MITRE T1611
TM-00000162 (T1547.006)Kernel Module Load via Syscall in Container Detects loading or unloading of a Linux kernel module via syscall from within a container. Loading a kernel module grants code execution in the host kernel and is a recognized container-escape and persistence primitive; issuing the syscall directly can evade detections based on the module utility process name. X Log MITRE T1547.006
TM-00000163 (T1611)Filesystem Mount via Syscall in Container Detects direct invocation of filesystem mount operations from within a container by a process other than the container runtime, including the modern mount API. Mounting a filesystem is a recognized container-escape primitive; performing it directly rather than via the standard administrative utility can evade process-name-based detections. X Log MITRE T1611
TM-00000164 (T1611)Host Filesystem Access via File Handle in Container Detects resolution of a file handle to open a file by inode from within a container by a process other than the container runtime. This technique can reference files outside the container filesystem and is associated with a well-known container-escape that reaches the host filesystem. X Log MITRE T1611
TM-00000165 (T1611)Pivot Root Mount Namespace Escape in Container Detects use of the pivot_root operation from within a container by a process other than the container runtime. Changing the root mount in this way is a recognized mount-namespace container-escape primitive used to break out of the container filesystem. X Log MITRE T1611
TM-00000166 (T1611)Device Node Creation in Container Detects creation of a device node from within a container by a process other than the container runtime. Creating block or character device nodes can expose host storage or hardware to the container and is associated with container-escape techniques. X Log MITRE T1611

 
Technical note: FIM scanning is schedule-based only — there is currently no continuous/real-time monitoring mode. Scan frequency is the only lever for balancing detection latency against event volume.
 

These rules provide a baseline starting point and should be tailored to your environment. Rule applicability depends on how your container images are built and configured. For example, distroless or scratch-based images may not include components such as a shell, package manager, SSH, or cron, making related rules unnecessary. Review the recommended rules against your workloads and disable any rules that are not applicable.

 

 

Rule What it monitors Monitored paths
Secrets and Private Keys

Any credential file appearing, changing, or having its permissions loosened. Flags unauthorized secrets or private keys being added or tampered with.

Monitored events: Create, Modify, Delete, Perms, Owner
  • /run/secrets/ — *.pem, *.key
  • /var/run/secrets/kubernetes.io/serviceaccount/ — token, ca.crt, namespace
  • /var/run/secrets/eks.amazonaws.com/serviceaccount/token
  • /var/run/secrets/azure/tokens/
Security Critical Binaries

Checksum, permission, or ownership changes to privileged executables. Flags binary replacement or trojaning of setuid/admin tools.

Monitored events: Content, Modify, Perms, Owner
  • /bin/, /sbin/, /usr/bin/, /usr/sbin/ — su, sudo, passwd, ssh, sshd, crontab, mount
  • /usr/bin/ — pkexec, chsh, chfn, newgrp, gpasswd, unshare, nsenter
  • /usr/sbin/chroot
  • /sbin/capsh
  • /usr/local/bin/, /usr/local/sbin/
SSH Configuration and Keys

New or edited SSH config, host keys, and authorized_keys entries. Flags backdoor key injection and sshd config tampering.

Monitored events: Create, Modify, Delete
  • /etc/ssh/ — sshd_config, sshd_config.d/, ssh_host_*_key, ssh_host_*.pub
  • /etc/ssh/ — ssh_config, ssh_config.d/
  • /root/.ssh/ — authorized_keys, authorized_keys2, config, id_*
  • /home/*/.ssh/ — authorized_keys, config
System Configuration Files

Edits to identity, auth, and dynamic-loader config. Flags account/privilege tampering and loader-preload hijacks.

Monitored events: Modify, Perms, Owner
  • /etc/ — passwd, shadow, group, sudoers, nsswitch.conf, ld.so.preload, ld.so.conf, ld.so.conf.d/, sudoers.d/

Orientation RD Resource
One of the basic things that you can do to secure the control plane is to perform integrity monitoring for the most critical Kubernetes files. By doing this, you will be alerted immediately of any change in the configuration. From a Kubernetes security perspective, critical files are those that can affect the entire cluster when compromised. Link
There are still organizations that make the critical mistake of leaving the kube-apiserver publicly exposed. Exposing your API server to the public is the most common entry point for attackers, and allows them to take over your cluster. Link
It is important to know that privileged containers can be used as entry points for attacks and to spread malicious code or malware to compromised hosts and networks. But this is not the only issue—there are other misconfigurations in containers that can put the underlying host at risk. Link
To prevent security issues, it is recommended that you do not run privileged containers in your environment. Instead, provide granular permissions and capabilities to the container environment. Giving containers full access to the host can create security flaws in your production environment. This is the reason that, by default, containers are “unprivileged” and cannot access all the devices in the host. However, this doesn’t mean that privileged containers should not be used at all. Some projects and environments may require its usage, but organizations need to make sure that safeguards and security recommendations are set in place when running such containers. Link
The analyzed samples don’t just search for resource-intensive processes on the host machine; they also look for deployed Docker containers that are conducting mining operations. This behavior aims to guarantee that the latest deployed malware gets to use the host’s computing power. Link
A common trend or technique that malware actors used in the past involved exploiting a vulnerability in a publicly hosted service to gain code execution privileges. This technique allowed an attacker to create a botnet or install a coinminer in the system. A newer technique that entails looking for open APIs, which allow sprawling containers or gain code execution privileges, is becoming more common. When it comes to cryptocurrency-mining malware, there has been a move from on-premise devices to containers and the cloud. Link
Keywords: Vision One Container Security policies,Vision One Container Security ruleset,Container ruleset