Suspicious Container Deployment or Execution

Shadows VMB@Vemorian_Mort

•updated 6 days ago•1•0•9

Detects the deployment or creation of containers (via Docker, Podman, Nerdctl, Crictl, or Kubectl) with elevated risk flags such as privileged mode, host namespace sharing, root mounts, docker socket access, or initiated from web application parent processes.