shashank-elastic 2c6976cce7 Add investigation guides (#5630) ...

(cherry picked from commit 3ee0a72a65)

2026-01-27 09:01:50 +00:00

..

command_and_control_curl_socks_proxy_detected_inside_container.toml

Add investigation guides (#5630)

2026-01-27 09:01:50 +00:00

container_workload_protection.toml

[New Rules] Reintroduction of Defend for Containers (D4C) Ruleset (#5561)

2026-01-26 15:41:51 +00:00

credential_access_cloud_creds_search_inside_a_container.toml

[New Rules] Reintroduction of Defend for Containers (D4C) Ruleset (#5561)

2026-01-26 15:41:51 +00:00

credential_access_collection_sensitive_files_compression_inside_a_container.toml

[New Rules] Reintroduction of Defend for Containers (D4C) Ruleset (#5561)

2026-01-26 15:41:51 +00:00

credential_access_sensitive_keys_or_passwords_search_inside_a_container.toml

[New Rules] Reintroduction of Defend for Containers (D4C) Ruleset (#5561)

2026-01-26 15:41:51 +00:00

credential_access_service_account_token_or_cert_read.toml

Add investigation guides (#5630)

2026-01-27 09:01:50 +00:00

defense_evasion_ld_preload_shared_object_modified_inside_a_container.toml

[New Rules] Reintroduction of Defend for Containers (D4C) Ruleset (#5561)

2026-01-26 15:41:51 +00:00

discovery_dns_enumeration.toml

Add investigation guides (#5630)

2026-01-27 09:01:50 +00:00

discovery_environment_enumeration.toml

Add investigation guides (#5630)

2026-01-27 09:01:50 +00:00

discovery_service_account_namespace_read.toml

Add investigation guides (#5630)

2026-01-27 09:01:50 +00:00

discovery_suspicious_network_tool_launched_inside_a_container.toml

[New Rules] Reintroduction of Defend for Containers (D4C) Ruleset (#5561)

2026-01-26 15:41:51 +00:00

discovery_tool_enumeration.toml

Add investigation guides (#5630)

2026-01-27 09:01:50 +00:00

execution_container_management_binary_launched_inside_a_container.toml

[New Rules] Reintroduction of Defend for Containers (D4C) Ruleset (#5561)

2026-01-26 15:41:51 +00:00

execution_direct_interactive_kubernetes_api_request.toml

Add investigation guides (#5630)

2026-01-27 09:01:50 +00:00

execution_interactive_exec_to_container.toml

[New Rules] Reintroduction of Defend for Containers (D4C) Ruleset (#5561)

2026-01-26 15:41:51 +00:00

execution_interactive_shell_spawned_from_inside_a_container.toml

[New Rules] Reintroduction of Defend for Containers (D4C) Ruleset (#5561)

2026-01-26 15:41:51 +00:00

execution_netcat_listener_established_inside_a_container.toml

[New Rules] Reintroduction of Defend for Containers (D4C) Ruleset (#5561)

2026-01-26 15:41:51 +00:00

execution_suspicious_file_made_executable_via_chmod_inside_a_container.toml

[New Rules] Reintroduction of Defend for Containers (D4C) Ruleset (#5561)

2026-01-26 15:41:51 +00:00

execution_tool_installation.toml

Add investigation guides (#5630)

2026-01-27 09:01:50 +00:00

persistence_ssh_authorized_keys_modification_inside_a_container.toml

[New Rules] Reintroduction of Defend for Containers (D4C) Ruleset (#5561)

2026-01-26 15:41:51 +00:00

privilege_escalation_debugfs_launched_inside_a_privileged_container.toml

[New Rules] Reintroduction of Defend for Containers (D4C) Ruleset (#5561)

2026-01-26 15:41:51 +00:00

privilege_escalation_mount_launched_inside_a_privileged_container.toml

[New Rules] Reintroduction of Defend for Containers (D4C) Ruleset (#5561)

2026-01-26 15:41:51 +00:00

privilege_escalation_potential_container_escape_via_modified_notify_on_release_file.toml

[New Rules] Reintroduction of Defend for Containers (D4C) Ruleset (#5561)

2026-01-26 15:41:51 +00:00

privilege_escalation_potential_container_escape_via_modified_release_agent_file.toml

[New Rules] Reintroduction of Defend for Containers (D4C) Ruleset (#5561)

2026-01-26 15:41:51 +00:00