Outbound communication to a malicious IPaddress

Suspicious process execution

Hidden malware and exploitation attempts

Lateral movement and internalreconnaissance

Malicious PowerShell Scripts

Outgoing attacks

Inbound RDP/SSH Brute force attacks

exposed K8s dashboards

creation of high privileged roles

creation of sensitive mounts

web shell detection

Suspicious Logins

Privileged container creation

SSH Server hosted in container

suspicious access to API

Exposed Docker API \ Services

Vulnerability management

SQL Injection

Suspicious Logins

SQL Brute Force

High priv SQL commands

Unusual Export location

Shell code discovered

Code injection discovered

Masquerading Windows Module Detected

memory process contains attack toolkit

shell code

PowerShell scripts

Fileless malware

Credential dumping