THREAT OPS › Threat News › Linux & Cloud Detection Engineering - TeamPCP Container Attack Scenario
Linux & Cloud Detection Engineering - TeamPCP Container Attack Scenario
<h2 id="introduction">Introduction</h2> <p>In <a href="https://www.elastic.co/security-labs/getting-started-with-defend-for-containers">the previous article</a>, we examined how Defend for Containers (D4C) is deployed, how its policy model operates, and how its runtime telemetry is structured. With that foundation in place, the next step is to move from configuration and field analysis to applied
MITRE ATT&CK techniques
- Web ServicesT1583.006
- Web ServicesT1584.006
- Systemd ServiceT1543.002
- Generative AIAML.T0016.002
Indicators of compromise
- ce3916f99fdf7e886d2889d7a815f59a248b7affsha1
- df9c27d82e74eb51e39376f1af30d2beb738c673sha1
- https://flare.io/learn/resources/blog/teampcp-cloud-native-ransomwareurl
- http://67.217.57.240:666/files/proxy.shurl
- http://update.aegis.aliyun.com/download/uninstall.shurl
- http://44.252.85.168:666/files/kube.pyurl
- 67.217.57.240ipv4
- 44.252.85.168ipv4
- static-www.elastic.codomain
- kubernetes.iodomain