> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Container Monitoring

## Monitoring Events

* [BPF Program Not Profiled](../k8sruntime/rules/bpf_program_not_profiled)
* [Directory traversal monitored file read](../k8sruntime/rules/directory_traversal_monitored_file_read)
* [Read sensitive file trusted after startup](../k8sruntime/rules/read_sensitive_file_trusted_after_startup)
* [Read sensitive file untrusted](../k8sruntime/rules/read_sensitive_file_untrusted)
* [Run shell untrusted](../k8sruntime/rules/run_shell_untrusted)
* [System user interactive](../k8sruntime/rules/system_user_interactive)
* [Terminal shell in container](../k8sruntime/rules/terminal_shell_in_container)
* [Contact K8S API Server From Container](../k8sruntime/rules/contact_k8s_api_server_from_container)
* [Netcat Remote Code Execution in Container](../k8sruntime/rules/netcat_remote_code_execution_in_container)
* [Search Private Keys or Passwords](../k8sruntime/rules/search_private_keys_or_passwords)
* [Clear Log Activities](../k8sruntime/rules/clear_log_activities)
* [Remove Bulk Data from Disk](../k8sruntime/rules/remove_bulk_data_from_disk)
* [Create Symlink Over Sensitive Files](../k8sruntime/rules/create_symlink_over_sensitive_files)
* [Create Hardlink Over Sensitive Files](../k8sruntime/rules/create_hardlink_over_sensitive_files)
* [Packet socket created in container](../k8sruntime/rules/packet_socket_created_in_container)
* [Redirect STDOUT or STDIN to Network Connection in Container](../k8sruntime/rules/redirect_stdout_stdin_to_network_connection_in_container)
* [Linux Kernel Module Injection Detected](../k8sruntime/rules/linux_kernel_module_injection_detected)
* [Debugfs Launched in Privileged Container](../k8sruntime/rules/debugfs_launched_in_privileged_container)
* [Detect release\_agent File Container Escapes](../k8sruntime/rules/detect_release_agent_file_container_escapes)
* [PTRACE attached to process](../k8sruntime/rules/ptrace_attached_to_process)
* [PTRACE anti-debug attempt](../k8sruntime/rules/ptrace_anti-debug_attempt)
* [Find AWS Credentials](../k8sruntime/rules/find_aws_credentials)
* [Execution from shm directory in dev directory](../k8sruntime/rules/execution_from_shm_directory_in_dev_directory)
* [Drop and execute new binary in container](../k8sruntime/rules/drop_and_execute_new_binary_in_container)
* [Disallowed SSH Connection Non Standard Port](../k8sruntime/rules/disallowed_ssh_connection_non_standard_port)
* [Unexpected inbound connection source](../k8sruntime/rules/unexpected_inbound_connection_source)
* [Read Shell Configuration File](../k8sruntime/rules/read_shell_configuration_file)
* [Update Package Repository](../k8sruntime/rules/update_package_repository)
* [Write below binary dir](../k8sruntime/rules/write_below_binary_dir)
* [Write below monitored dir](../k8sruntime/rules/write_below_monitored_dir)
* [Write below etc](../k8sruntime/rules/write_below_etc)
* [Write below root](../k8sruntime/rules/write_below_root)
* [Write below rpm database](../k8sruntime/rules/write_below_rpm_database)
* [Modify binary dirs](../k8sruntime/rules/modify_binary_dirs)
* [Mkdir binary dirs](../k8sruntime/rules/mkdir_binary_dirs)
* [Launch Sensitive Mount Container](../k8sruntime/rules/launch_sensitive_mount_container)
* [Launch Disallowed Container](../k8sruntime/rules/launch_disallowed_container)
* [Interpreted procs inbound network activity](../k8sruntime/rules/interpreted_procs_inbound_network_activity)
* [Unexpected K8s NodePort Connection](../k8sruntime/rules/unexpected_k8s_nodeport_connection)
* [Create Hidden Files or Directories](../k8sruntime/rules/create_hidden_files_or_directories)
* [Detect outbound connections to common miner pool ports](../k8sruntime/rules/detect_outbound_connections_to_common_miner_pool_ports)
* [Detect crypto miners using the Stratum protocol](../k8sruntime/rules/detect_crypto_miners_using_the_stratum_protocol)
* [The docker client is executed in a container](../k8sruntime/rules/the_docker_client_is_executed_in_a_container)
* [Container Drift Detected (chmod)](../k8sruntime/rules/container_drift_detected_\(chmod\))
* [Container Drift Detected (open+create)](../k8sruntime/rules/container_drift_detected_\(open+create\))
* [Container Run as Root User](../k8sruntime/rules/container_run_as_root_user)
* [Sudo Potential Privilege Escalation](../k8sruntime/rules/sudo_potential_privilege_escalation)
* [Unprivileged Delegation of Page Faults Handling to a Userspace Process](../k8sruntime/rules/unprivileged_delegation_of_page_faults_handling_to_a_userspace_process)
* [Polkit Local Privilege Escalation Vulnerability (CVE-2021-4034)](../k8sruntime/rules/polkit_local_privilege_escalation_vulnerability_\(cve-2021-4034\))
* [Java Process Class File Download](../k8sruntime/rules/java_process_class_file_download)
* [Modify Container Entrypoint](../k8sruntime/rules/modify_container_entrypoint)
* [Decoding Payload in Container](../k8sruntime/rules/decoding_payload_in_container)
* [Modify Shell Configuration File](../k8sruntime/rules/modify_shell_configuration_file)
* [Schedule Cron Jobs](../k8sruntime/rules/schedule_cron_jobs)
* [Read ssh information](../k8sruntime/rules/read_ssh_information)
* [DB program spawned process](../k8sruntime/rules/db_program_spawned_process)
* [Change thread namespace](../k8sruntime/rules/change_thread_namespace)
* [Launch Privileged Container](../k8sruntime/rules/launch_privileged_container)
* [Launch Excessively Capable Container](../k8sruntime/rules/launch_excessively_capable_container)
* [System procs network activity](../k8sruntime/rules/system_procs_network_activity)
* [Program run with disallowed http proxy env](../k8sruntime/rules/program_run_with_disallowed_http_proxy_env)
* [Unexpected UDP Traffic](../k8sruntime/rules/unexpected_udp_traffic)
* [Non sudo setuid](../k8sruntime/rules/non_sudo_setuid)
* [User mgmt binaries](../k8sruntime/rules/user_mgmt_binaries)
* [Create files below dev](../k8sruntime/rules/create_files_below_dev)
* [Contact EC2 Instance Metadata Service From Container](../k8sruntime/rules/contact_ec2_instance_metadata_service_from_container)
* [Contact cloud metadata service from container](../k8sruntime/rules/contact_cloud_metadata_service_from_container)
* [Launch Package Management Process in Container](../k8sruntime/rules/launch_package_management_process_in_container)
* [Launch Suspicious Network Tool in Container](../k8sruntime/rules/launch_suspicious_network_tool_in_container)
* [Launch Suspicious Network Tool on Host](../k8sruntime/rules/launch_suspicious_network_tool_on_host)
* [Delete or rename shell history](../k8sruntime/rules/delete_or_rename_shell_history)
* [Set Setuid or Setgid bit](../k8sruntime/rules/set_setuid_or_setgid_bit)
* [Launch Remote File Copy Tools in Container](../k8sruntime/rules/launch_remote_file_copy_tools_in_container)
* [Network Connection outside Local Subnet](../k8sruntime/rules/network_connection_outside_local_subnet)
* [Mount Launched in Privileged Container](../k8sruntime/rules/mount_launched_in_privileged_container)
* [Launch Ingress Remote File Copy Tools in Container](../k8sruntime/rules/launch_ingress_remote_file_copy_tools_in_container)
* [Read environment variable from proc files](../k8sruntime/rules/read_environment_variable_from_proc_files)
* [Exfiltrating Artifacts via Kubernetes Control Plane](../k8sruntime/rules/exfiltrating_artifacts_via_kubernetes_control_plane)
* [Fileless execution via memfd\_create](../k8sruntime/rules/fileless_execution_via_memfd_create)
* [Adding ssh keys to authorized\_keys](../k8sruntime/rules/adding_ssh_keys_to_authorized_keys)
* [Backdoored library loaded into SSHD (CVE-2024-3094)](../k8sruntime/rules/backdoored_library_loaded_into_sshd_\(cve-2024-3094\))
* [Basic Interactive Reconnaissance](../k8sruntime/rules/basic_interactive_reconnaissance)
* [Change namespace privileges via unshare](../k8sruntime/rules/change_namespace_privileges_via_unshare)
* [Disallowed SSH Connection](../k8sruntime/rules/disallowed_ssh_connection)
* [Execution from dev shm](../k8sruntime/rules/execution_from_dev_shm)
* [Kubernetes Client Tool Launched in Container](../k8sruntime/rules/kubernetes_client_tool_launched_in_container)
* [Outbound Connection to C2 Servers](../k8sruntime/rules/outbound_connection_to_c2_servers)
* [Outbound or Inbound Traffic not to Authorized Server Process and Port](../k8sruntime/rules/outbound_or_inbound_traffic_not_to_authorized_server_process_and_port)
* [Potential Local Privilege Escalation via Environment Variables Misuse](../k8sruntime/rules/potential_local_privilege_escalation_via_environment_variables_misuse)
* [Redirect STDOUT STDIN to Network Connection in Container](../k8sruntime/rules/redirect_stdout_stdin_to_network_connection_in_container)
* [Unexpected outbound connection destination](../k8sruntime/rules/unexpected_outbound_connection_destination)