Others

• Cloud Provider: Indicates attempts to abuse a provider’s service to extract sensitive information.

  For example: Container A queried provider API at <IP_ADDRESS>.
• Data Exfiltration: Indicates a potential compromise on a container because of a modified binary listening on a port. This typically leads with a DNS suspicious activity.

  For example: Container process /bin/bash is listening on unexpected port 50000.
• Hijacked Process: Indicates that an allowed process was used in a way that is inconsistent with its expected behavior. This can be a sign that a process has been used to compromise a container.