Attach/Exec Pod

Telemetry coverage

Rules detecting the same action

These rules filter on the same operation.

• Azure AKS Attempted User Exec into Pod (Elastic)
• Container With A hostPath Mount Created (Sigma)
• Create Disallowed Pod (Falco)
• Create HostIPC Pod (Falco)
• Create HostNetwork Pod (Falco)
• Create HostPid Pod (Falco)
• Create Privileged Pod (Falco)
• Create Sensitive Mount Pod (Falco)

Stages and Predicates

and
  not
    jevt.rawtime eq "0"
  or
    verb eq "create"
    verb eq "get"
  objectRef.resource eq "pods"
  objectRef.subresource in ["attach", "exec"]
  objectRef.subresource is_not_null
  stage eq "ResponseStarted"

Exclusions

The rule actively suppresses these predicates.

Indicators

These rows show field, operator, and value matches.