Backdoored ARTEX Docker image pulled/run, followed by shell spawned from container
Detects the pulling and execution of known backdoored ARTEX Docker Hub images followed by a shell execution within a container runtime on the same device within a one-hour window.
Microsoft Sentinel (KQL)
