Austin Mundy
@letitgo90Completionist
0 followers23 downloads4 copies2 likes350 views
2 detections
Filters
Last updated
All Time
Detection languages
2
Categories
1
1
1
Platforms
2
Products / Services
2
MITRE Techniques
1
1
1
1
1
Detects curl or wget accessing the default Kubernetes service account token path. Adapted from Unit 42 reporting on Slow Pisces and React2Shell (CVE-2025-55182) campaigns.
Detects TCP connections to ports commonly associated with reverse shells,
C2 frameworks, and attacker tooling, as observed by Tetragon eBPF kernel-level
network monitoring. After initial container compromise, attackers establish
outbound connections on non-standard ports to maintain command and control.
Tetragon provides full process context (binary, pod, namespace, parent process)
tied to the network event, enabling high-fidelity correlation.
C2 frameworks, and attacker tooling, as observed by Tetragon eBPF kernel-level
network monitoring. After initial container compromise, attackers establish
outbound connections on non-standard ports to maintain command and control.
Tetragon provides full process context (binary, pod, namespace, parent process)
tied to the network event, enabling high-fidelity correlation.