AN0691
Analytic 0691
Linux
CONTAINERS (Docker/K8s/containerd): A user pulls an untrusted image from a public/unknown registry and then creates/starts a container from that image. Shortly after start, the container spawns unexpected utilities (e.g., curl/wget/bash/python), or makes outbound network connections atypical for the namespace/workload. The analytic correlates Image Creation/Download → Container Creation → Container Start → Command Execution/Network activity within a short window and with a consistent image digest.
containerd:events
Image pull from untrusted registry (name NOT IN allowlist) or new digest never seen before
kubernetes:audit
create: Pod/Container created with image tag 'latest' or mutable tag; imagePullPolicy=Always; noDigest=true
kubernetes:events
start: ContainerStarted or Pulling image → Started container
auditd:SYSCALL
execve: Process in container namespace executes curl|wget|bash|sh|python|nc with outbound args
NSM:Flow
New egress from container IP/namespace to Internet or non-approved CIDRs/ASNs
[ImageRegistryAllowList]
Approved registries/namespaces (e.g., ECR/GCR/ACR org repos).
[TimeWindow]
Correlation window from image pull to container activity (e.g., ≤15m).
[SuspiciousBinaries]
Executables treated as high-risk when run in app containers (bash, sh, curl, wget, nc, powershell for Windows containers).
[NamespaceScope]
K8s namespaces that should never pull from Internet or run mutable tags.
[OutboundCIDRBlockList]
Destination networks/domains that should not be contacted by containers.
AN0692
Analytic 0692
Windows
IAAS (Cloud images/VMs): A new VM/instance is launched from a non-approved or newly-seen image (AMI/GCP Image/Azure Image). On first boot, cloud-init/user-data or embedded agents download code, spawn system utilities, or open outbound C2/mining traffic. The analytic correlates Instance/Image Creation → Instance Start → in-guest Process/Command Execution and/or anomalous network traffic.
AWS:CloudTrail
RunInstances
azure:activity
Microsoft.Compute/virtualMachines/write: imageReference publisher NOT IN allowlist OR plan is new/unknown
WinEventLog:Sysmon
EventCode=1
NSM:Flow
New VM egress to crypto-mining pools or non-approved Internet ranges within minutes of boot
[ApprovedImageCatalog]
Set of golden images/owners and digest/IDs allowed to launch.
[UserDataInspection]
Whether to alert when userData/cloud-init contains exec or download directives.
[FirstBootWindow]
Time after start considered first-boot (e.g., ≤30m) for correlation.
[VMTagScope]
Restrict detection to prod or internet-facing subnets to reduce noise.