Resource enumerated using kubectl in container


Detect the use of kubectl inside a container to enumerate Kubernetes resources.


This detection triggers when kubectl is executed with specific arguments related to discovering Kubernetes resources. These arguments include cluster-info and retrieving all namespaces.

Triage and response

  1. Identify the purpose of the container using tags, such as the image and service tags.
  2. Determine the targets of the enumeration using the process arguments.
  3. Initiate the incident response process.
  4. Remediate compromised resources and repair the root cause.

Requires Agent version 7.27 or greater