EphemeralContainers Created

Telemetry coverage

Rules detecting the same action

These rules filter on the same operation.

• Attach/Exec Pod (Falco)
• Azure AKS Attempted User Exec into Pod (Elastic)
• Azure AKS Ephemeral Container Added to Pod (Elastic)
• Container With A hostPath Mount Created (Sigma)
• Create Disallowed Pod (Falco)
• Create HostIPC Pod (Falco)
• Create HostNetwork Pod (Falco)
• Create HostPid Pod (Falco)

Stages and Predicates

and
  not
    jevt.rawtime eq "0"
  objectRef.resource eq "pods"
  objectRef.subresource eq "ephemeralcontainers"
  objectRef.subresource is_not_null
  stage eq "ResponseComplete"
  verb in ["create", "patch", "update"]

Exclusions

The rule actively suppresses these predicates.

Indicators

These rows show field, operator, and value matches.