TeamPCP Privileged Kubernetes Pod Creation
Detects the creation of highly privileged Kubernetes pods in the 'kube-system' namespace matching the naming convention 'node-setup-*', indicative of TeamPCP lateral movement techniques. These pods request elevated privileges such as 'hostPID', 'hostNetwork', and 'privileged'.
Microsoft Sentinel (KQL)
