> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/runtime-security/runtime-defense/runtime-audits.md).

# Runtime Audits

This document summarizes all the runtime audits (detections) that are available in Prisma Cloud Compute. For each detection, you can learn more about what it actually detects, how to enable or disable it, avoid false positives, relevant workloads (Containers, Hosts, Serverless and App-embedded), and if the audit also generates an incident.

## Runtime detections for processes

| Detection                        | Context                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | Audit message                                                                                                                                                        | Triggers an incident                                                                                         | Workloads                                   |
| -------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------ | ------------------------------------------- |
| Unexpected Process               | <p>Indicates when a process that is not part of the runtime model was spawned.</p><ul><li>Avoid audits for specific known and allowed processes, by adding the process name to the runtime rules processes <strong>Allowed</strong> list.</li><li>In order to add the processes to the model, navigate to the relevant model under <strong>Monitor > Runtime > Container</strong> models, then click on <strong>…​</strong> and select <strong>Extend learning</strong></li></ul>                                                                                                                         | <ul><li>\<process> launched but is not found in the runtime model</li><li>\<process> launched from \<parent process> but is not found in the runtime model</li></ul> |                                                                                                              | Containers                                  |
| Explicitly Denied Process        | <p>Indicates that a process listed in the <strong>Denied & fallback</strong> list was spawned.</p><ul><li>For App-embedded and Serverless, this indicates that a process that is not listed in the <strong>Allowed</strong> list was spawned</li></ul>                                                                                                                                                                                                                                                                                                                                                    | \<process> launched and is explicitly denied by runtime rule. Full command \<command>                                                                                |                                                                                                              | Containers, Host, Serverless, App-embedded  |
| Modified Process                 | <p>Indicates a modified process was spawned. A modified process is a process whose binary was created or modified after the container was started.</p><ul><li>Enable and disable this detection via the <strong>Processes started from modified binaries</strong> toggle, under the Runtime rule Processes tab</li><li>Avoid audits on specific known and allowed processes, by adding process names to the runtime rules processes <strong>Allowed</strong> list.</li></ul>                                                                                                                              | A modified executable \<process> was launched                                                                                                                        |                                                                                                              | Containers, App-embedded                    |
| Altered Binary                   | <p>Indicates that a package binary file was replaced during image build. This detection will generate an audit when a process is started from an altered binary.</p><ul><li>Enable and disable this detection via the <strong>Processes started from modified binaries</strong> toggle, under the Runtime rule Processes tab</li><li>Avoid audits on specific known and allowed processes, by adding process names to the runtime rules processes <strong>Allowed</strong> list.</li></ul>                                                                                                                | \<process path> launched and is detected as an altered or corrupted package binary. The file metadata doesn’t match what’s reported by the package manager.          | [Altered binary](/content-collections/runtime-security/runtime-defense/incident-types/altered-binary.md)     | Containers, App-embedded                    |
| Crypto Miner Process             | <p>Indicates a process that is identified as a crypto miner was spawned.</p><ul><li>Enable and disable this detection via the <strong>Crypto miners</strong> toggle, under the Runtime rule Processes / Anti-malware tab.</li><li>Avoid audits on specific known and allowed processes, by adding process names to the runtime rules processes <strong>Allowed</strong> list.</li></ul>                                                                                                                                                                                                                   | \<process> launched and is identified as a crypto miner. Full command: \<path>                                                                                       | [Crypto miners](/content-collections/runtime-security/runtime-defense/incident-types/crypto-miners.md)       | Containers, Hosts, Serverless, App-embedded |
| Lateral Movement Process         | <p>Indicates a process that is used for lateral movement was spawned.</p><ul><li>Enable and disable this detection via the <strong>Processes used for lateral movement</strong> toggle, under the Runtime rule Processes tab.</li><li>Avoid audits on specific known and allowed processes, by adding process names to the runtime rules processes <strong>Allowed</strong> list.</li></ul>                                                                                                                                                                                                               | \<process> launched and is identified as a process used for lateral movement. Full command: \<path>                                                                  | [Lateral movement](/content-collections/runtime-security/runtime-defense/incident-types/lateral-movement.md) | Containers                                  |
| Temporary File System Process    | <p>Indicates that a process is running from a temporary file system.</p><ul><li>Enable and disable this detection via the <strong>Processes running from temporary storage</strong> toggle, under the Runtime rule Anti-malware tab.</li><li>Avoid audits on specific known and allowed processes, by adding process names to the runtime rules processes <strong>Allowed</strong> list.</li></ul>                                                                                                                                                                                                        | \<process> launched from a temporary file storage, which usually indicates malicious activity.                                                                       |                                                                                                              | Hosts                                       |
| Policy Hijacked                  | Indicates that the Prisma Cloud process policy was hijacked                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | Possible tampering of Defender policy detected.                                                                                                                      |                                                                                                              | Serverless                                  |
| Reverse Shell                    | <p>Indicates that a process was identified as running a reverse shell</p><ul><li>Enable and disable this detection via the <strong>Reverse shell attacks</strong> toggle, under the Runtime rule Processes / Anti-malware tab.</li><li>Avoid audits on specific known and allowed processes, by adding process names to the runtime rules processes <strong>Allowed</strong> list.</li></ul>                                                                                                                                                                                                              | \<processes> is a reverse shell. Full command: \<path>                                                                                                               | [Reverse shell](/content-collections/runtime-security/runtime-defense/incident-types/reverse-shell.md)       | Containers, Hosts                           |
| Suid Binaries                    | <p>Indicates that a process is running with high privileges, by watching for binaries with the setuid bit that are executed.</p><ul><li>Enable and disable this detection via the <strong>Processes started with SUID</strong> toggle, under the Runtime rule Processes tab.</li></ul>                                                                                                                                                                                                                                                                                                                    | \<process> launched and detected as a process started with SUID. Full command: \<path>                                                                               |                                                                                                              | Containers                                  |
| Unknown Origin Binary by service | <p>Indicates detection of binaries created by a service without a package manager.</p><ul><li>Enable and disable this detection via the <strong>Non-packaged binaries created or run by service</strong> toggle, under the Runtime rule Anti-malware tab.</li><li>You can also select to <strong>Suppress detection for binaries created by compilation tools</strong>, to ignore binaries that are created by a specific compilation tool.</li><li>Avoid audits on specific known and allowed processes, by adding process names to the runtime rules processes <strong>Allowed</strong> list.</li></ul> | \<process path> launched from a binary file which was written by \<creating process path> that is not known OS distribution package manager.                         |                                                                                                              | Hosts                                       |
| Unknown Origin Binary by user    | <p>Indicates detection of a binary created by a user without a package manager.</p><ul><li>Enable and disable this detection via the <strong>Non-packaged binaries created or run by user</strong> toggle, under the Runtime rule Anti-malware tab.</li><li>Avoid audits on specific known and allowed processes, by adding process names to the runtime rules processes <strong>Allowed</strong> list.</li></ul>                                                                                                                                                                                         | \<process path> launched from a binary file which was written by \<creating process path> that is not known OS distribution package manager.                         |                                                                                                              | Hosts                                       |
| Web Shell                        | <p>Indicates that the process was launched by a web shell</p><ul><li>Enable and disable this detection via the <strong>Webshell attacks</strong> toggle, under the Runtime rule Anti-malware tab.</li><li>Avoid audits on specific known and allowed processes, by adding process names to the runtime rules processes <strong>Allowed</strong> list.</li></ul>                                                                                                                                                                                                                                           | \<process path> suspected to be launched by a webshell at \<path>                                                                                                    |                                                                                                              | Hosts                                       |

## Container general runtime detections

| Detection               | Context                                                                                                                                                                                                                                                                                                                                                                  | Audit message                                        | Trigger an incident                                                                                             | Workloads  |
| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------- | --------------------------------------------------------------------------------------------------------------- | ---------- |
| Cloud Metadata Probing  | <p>Indicates the container is trying to access a cloud provider metadata server.</p><ul><li>Enable and disable this detection via the <strong>Suspicious queries to cloud provider APIs</strong> toggle, under the Runtime rule Anti-malware tab</li></ul>                                                                                                               | Container queried provider API at \<address>         | [Cloud Provider](/content-collections/runtime-security/runtime-defense/incident-types/others.md)                | Containers |
| Kubelet API Access      | <p>Indicates that a container is trying to access the Kubelet main API.</p><ul><li>Enable and disable this detection via the <strong>Kubernetes attacks</strong> toggle, under the Runtime rule Anti-malware tab.</li></ul>                                                                                                                                              | Container queried kubelet API at \<address>          | [Kubernetes attacks](/content-collections/runtime-security/runtime-defense/incident-types/kubernetes-attack.md) | Containers |
| Kubelet Readonly Access | <p>Indicates that a container is trying to access the Kubelet readonly API.</p><ul><li>Enable and disable this detection via the <strong>Kubernetes attacks</strong> toggle, under the Runtime rule Anti-malware tab.</li></ul>                                                                                                                                          | Container queried kubelet readonly API at \<address> | [Kubernetes attacks](/content-collections/runtime-security/runtime-defense/incident-types/kubernetes-attack.md) | Containers |
| Kubectl Spawned         | <p>Indicates the kubectl process was spawned from the container.</p><ul><li>Enable and disable this detection via the <strong>Kubernetes attacks</strong> toggle, under the Runtime rule Anti-malware tab.</li><li>Avoid audits on specific known and allowed processes, by adding process names to the runtime rules processes <strong>Allowed</strong> list.</li></ul> | kubelet launched inside a container                  | [Kubernetes attacks](/content-collections/runtime-security/runtime-defense/incident-types/kubernetes-attack.md) | Containers |
| Kubectl Downloaded      | <p>Indicates that the kubectl binary was downloaded and written to the disk.</p><ul><li>Enable and disable this detection via the <strong>Kubernetes attacks</strong> toggle, under the Runtime rule Anti-malware tab.</li></ul>                                                                                                                                         | \<process path> downloaded kubectl to container.     | [Kubernetes attacks](/content-collections/runtime-security/runtime-defense/incident-types/kubernetes-attack.md) | Containers |

## Runtime detections for Network activities

| Detection                        | Context                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | Audit message                                                                                                                                                                        | Trigger an incident                                                                                    | Workloads                                   |
| -------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------ | ------------------------------------------- |
| Horizontal Port Scanning         | <p>Indicates horizontal port scanning detected</p><ul><li>Enable and disable this detection via the <strong>Port scanning</strong> toggle, under the Runtime rule Networking tab.</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | Horizontal port scanning \<process> to target IP \<IP address> detected. Target ports \<ports>                                                                                       | [Port scanning](/content-collections/runtime-security/runtime-defense/incident-types/port-scanning.md) | Containers                                  |
| Vertical Port Scanning           | <p>Indicates vertical port scanning detected</p><ul><li>Enable and disable this detection via the <strong>Port scanning</strong> toggle, under the Runtime rule Networking tab.</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | Vertical port scanning \<process> to target IP \<IP address> detected. Target ports \<ports>                                                                                         | [Port scanning](/content-collections/runtime-security/runtime-defense/incident-types/port-scanning.md) | Containers                                  |
| Explicitly Denied IP             | <p>Indicates that access to an IP address listed in the <strong>Denied & fallback</strong> list was detected.</p><p>For App-embedded and Serverless, this indicates that access was detected to an IP address that is not listed in the <strong>Allowed</strong> list</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | Outbound connection \<process> to IP \<ip address> is explicitly denied by a runtime rule                                                                                            |                                                                                                        | Containers, Hosts, Serverless, App-embedded |
| Custom Feed IP                   | <p>Indicates detection of a connection to a high risk IP, based on a custom feed.</p><ul><li>Enable and disable this detection for <strong>Containers</strong> via the <strong>Prisma Cloud advanced threat protection</strong> toggle, under the Runtime rule Anti-malware tab.</li><li>Enable and disable this detection for <strong>Hosts</strong> via the <strong>Suspicious IPs based on custom feed</strong> toggle, under the Runtime rule Networking tab.</li></ul>                                                                                                                                                                                                                                                                                                                                             | Connect to \<address> is high risk, based on custom IP feed.                                                                                                                         |                                                                                                        | Containers, Hosts                           |
| Feed IP                          | <p>Indicates a connection to a high risk IP, based on intelligence feed data.</p><ul><li>Enable and disable this detection for <strong>Containers</strong> via the <strong>Prisma Cloud advanced threat protection</strong> toggle, under the Runtime rule Anti-malware tab.</li><li>Enable and disable this detection for <strong>Hosts</strong> via the <strong>Suspicious IPs based on Prisma Cloud advanced threat protection</strong> toggle, under the Runtime rule Networking tab.</li></ul>                                                                                                                                                                                                                                                                                                                     | Connect to \<address> is high risk. Intelligence stream categorizes \<address> as \<malware>.                                                                                        |                                                                                                        | Containers, Hosts                           |
| Unexpected Outbound Port         | <p>Indicates detection of an outbound connection on a port that is not part of the runtime model.</p><ul><li>To avoid audits on specific ports, add the port to the runtime rule’s Networking <strong>Outbound internet ports</strong> Allowed list, under <strong>Defend > Runtime > Container policies</strong> rules.</li><li>In order to add the processes to the model, navigate to the relevant model under <strong>Monitor > Runtime > Container</strong> models, click on <strong>…​</strong> and select Extend learning</li></ul>                                                                                                                                                                                                                                                                              | Outbound connection to an unexpected port: \<destination port> IP: \<destination ip>                                                                                                 |                                                                                                        | Containers                                  |
| Unexpected Listening Port        | <p>Indicates a container process is listening on a port that is not part of the runtime model.</p><ul><li>To avoid audits on specific ports, add the port to the runtime rule’s Networking <strong>Listening ports</strong> Allowed list, under <strong>Defend > Runtime > Container policies</strong> rules.</li><li>In order to add the processes to the model, navigate to the relevant model under <strong>Monitor > Runtime > Container</strong> models, click on the <strong>…​</strong> and select Extend learning</li></ul>                                                                                                                                                                                                                                                                                     | Process \<process path> is listening on unexpected port \<port>                                                                                                                      |                                                                                                        | Containers                                  |
| Suspicious Network Activity      | <p>Indicates detection of a process performing raw socket usage.</p><ul><li>Enable and disable this detection via the <strong>Raw sockets</strong> toggle, under the Runtime rule Networking tab.</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | <p>Process \<process name> performed suspicious raw network activity, \<attack></p><ul><li>The \<attack> could indicate an ARP spoofing attempt or a port scanning attempt</li></ul> |                                                                                                        | Containers                                  |
| Explicitly Denied Listening Port | <p>Indicates a container process is listening on a port that is explicitly listed in the <strong>Listening ports</strong> list, under <strong>Denied & fallback</strong>.</p><p>For App-embedded, this indicates ports that are not listed in the Allowed Listening ports list, or they are on the denied list.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | Process \<process name> is listening on port \<port> explicitly denied by a runtime rule                                                                                             |                                                                                                        | Containers, Hosts, Serverless, App-embedded |
| Explicitly Denied Outbound Port  | <p>Indicates a container process uses an outbound port that is explicitly listed in the <strong>Outbound internet ports</strong> list under <strong>Denied & fallback</strong>.</p><p>For App-embedded, this indicates ports that are not listed in the <strong>Outbound ports</strong> list under <strong>Allowed</strong>, or they are on the denied list.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                        | Outbound connection \<process> to port \<destination port> (IP: \<destination ip>) is explicitly denied by a runtime rule.                                                           |                                                                                                        | Containers, Hosts, Serverless, App-embedded |
| Listening Port Modified Process  | <p>Indicates a container modified process is listening on an unexpected port.</p><ul><li>Enable and disable this detection via the <strong>Networking activity from modified binaries</strong> toggle, under the Runtime rule Networking tab.</li><li>To avoid getting such an event for an allowed port, add the port to the Runtime rule’s <strong>Allowed Listening ports</strong> list.</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                   | Container process \<process> was modified and is listening on unexpected port                                                                                                        |                                                                                                        | Containers                                  |
| Outbound Port Modified Process   | <p>Indicates a container modified process opened an outbound port.</p><ul><li>Enable and disable this detection via the <strong>Networking activity from modified binaries</strong> toggle, under the Runtime rule Networking tab.</li><li>To avoid getting such an event for an allowed port, add the port to the Runtime rule’s <strong>Allowed Outbound internet ports</strong> list.</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                      | Outbound connection by modified process \<process> to port: \<destination port> IP: \<destination IP>                                                                                |                                                                                                        | Containers                                  |
| Feed DNS                         | <p>Indicates a DNS resolution query for a high risk domain, based on an intelligence stream.</p><ul><li>Enable and disable this detection for <strong>Containers</strong> via the <strong>Prisma Cloud advanced threat protection</strong> toggle, under the Runtime rule Anti-malware tab.</li><li>Enable and disable this detection for <strong>Hosts</strong> via the <strong>Suspicious domains based on Prisma Cloud advanced threat protection</strong> toggle, under the Runtime rule Networking tab.</li><li>Make sure that the DNS toggle in the Runtime rule Networking tab is enabled as well</li><li>To avoid getting such an event for a known and allowed domain, add the domain name to the Runtime rule’s <strong>Domains</strong> list under <strong>Allowed</strong> in the Networking tab.</li></ul> | \<domain name> identified as high risk. Intelligence feed categorizes this domain as \<malicious category>                                                                           |                                                                                                        | Containers, Hosts                           |
| Explicitly Denied DNS            | <p>Indicates a DNS resolution query for a blacklisted domain, that is explicitly listed in the <strong>Domains</strong> list, under <strong>Denied & fallback</strong> in the Networking tab.</p><p>For App-embedded and Serverless, this indicates domains that are not listed in the Allowed Domains list.</p><ul><li>Make sure that the DNS toggle in the Runtime rule Networking tab is enabled as well.</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                  | DNS resolution of domain name \<domain name> triggered by \<process path> explicitly denied by runtime rule.                                                                         |                                                                                                        | Containers, Hosts, Serverless, App-Embedded |
| DNS Query                        | <p>Indicates a DNS resolution query of a domain name that is not part of the runtime model.</p><ul><li>To avoid getting such an event for a known and allowed domain, add the domain name to the Runtime rule’s <strong>Domains</strong> list, under <strong>Allowed</strong> in the Networking tab.</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | DNS resolution of suspicious name \<domain name>, type \<domain type>                                                                                                                |                                                                                                        | Containers                                  |

## Runtime detections for File system activities

| Detection                     | Context                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | Audit message                                                                                                                                                                                                                                                                  | Trigger an incident                                                                                                                    | Workloads                            |
| ----------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------ |
| Administrative Account        | <p>Indicates that an administrative account file was accessed. Changes to such files can be related to backdoor attacks.</p><ul><li>Enable and disable this detection via the <strong>Changes to SSH and admin account configuration files</strong> toggle, under the Container/App-Embedded Runtime rule’s File system tab.</li><li>To ignore such a detection for a known and allowed process, create a Runtime custom rule that allows these file changes by a specific process.</li></ul>                                                                                                                                                                              | \<process name> wrote to administrative accounts configuration file \<path>                                                                                                                                                                                                    | [Backdoor admin accounts](/content-collections/runtime-security/runtime-defense/incident-types/backdoor-admin-accounts.md)             | Containers, App-Embedded             |
| SSH Access                    | <p>Indicates that an ssh config file was accessed</p><ul><li>Enable and disable this detection via the <strong>Changes to SSH and admin account configuration files</strong> toggle, under the Container/App-Embedded Runtime rule’s File system tab.</li><li>To ignore such a detection for a known and allowed process, create a Runtime custom rule that allows these file changes by a specific process.</li></ul>                                                                                                                                                                                                                                                     | \<process name> wrote to SSH configuration file \<path>                                                                                                                                                                                                                        | [Backdoor SSH access](/content-collections/runtime-security/runtime-defense/incident-types/backdoor-ssh-access.md)                     | Containers, App-Embedded             |
| Encrypted Binary              | <p>Indicates that an encrypted binary was written to disk, by checking the binary entropy.</p><ul><li>Enable and disable this detection via the <strong>Detection of encrypted/packed binaries</strong> toggle, under the <strong>Container/App-Embedded</strong> Runtime rule File system tab.</li><li>Enable and disable this detection via the <strong>Encrypted/packed binaries</strong> toggle, under the <strong>Host</strong> Runtime rule Anti-malware tab.</li><li>To ignore such a detection for a known and allowed process, create a Runtime custom rule that allows these file changes by a specific process.</li></ul>                                       | \<process name> wrote a suspicious packed/encrypted binary to \<path>. Packing/encryption can conceal malicious executables.                                                                                                                                                   | [Suspicious binary](/content-collections/runtime-security/runtime-defense/incident-types/suspicious-binary.md)                         | Containers, Hosts, App-Embedded      |
| Explicitly Denied File        | Indicates that a file listed in the File system **Denied & fallback** list was accessed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | \<process name> changed explicitly monitored file \<path>                                                                                                                                                                                                                      |                                                                                                                                        | Containers, App-Embedded             |
| Malware File Custom           | <p>Indicates that a file that is identified as malware, based on a custom feed, was accessed.</p><ul><li>Enable and disable this detection for <strong>Containers</strong> via the <strong>Prisma Cloud advanced threat protection</strong> toggle, under the Runtime rule Anti-malware tab.</li><li>Enable and disable this detection for <strong>Hosts</strong> via the <strong>Malware based on custom feed</strong> toggle, under the Runtime rule Anti-malware tab.</li><li>Enable and disable this detection for App-embedded via the Custom feed for malware detection toggle, under the Runtime rule File system tab.</li></ul>                                    | \<process name> created \<file path> which was detected as \<malware name> malware in the custom malware feed                                                                                                                                                                  | [Malware](/content-collections/runtime-security/runtime-defense/incident-types/malware.md)                                             | Containers, Hosts, App-Embedded      |
| Malware File Feed             | <p>Indicates that a file that is identified as malware, based on the intelligence stream, was accessed.</p><ul><li>Enable and disable this detection for <strong>Containers</strong> via the <strong>Prisma Cloud advanced threat protection</strong> toggle, under the Runtime rule Anti-malware tab.</li><li>Enable and disable this detection for <strong>Hosts</strong> via the Malware based on <strong>Prisma Cloud advanced threat protection</strong> toggle, under the Runtime rule Anti-malware tab.</li></ul>                                                                                                                                                   | Process \<process name> created the file \<file path> which was detected as malicious. Intelligence feed identifies the file as \<malware name>                                                                                                                                | [Malware](/content-collections/runtime-security/runtime-defense/incident-types/malware.md)                                             | Containers, Hosts                    |
| Executable File Access        | <p>Indicates that an executable file was written.</p><ul><li>Enable and disable this detection via the <strong>Changes to binaries and certificates</strong> toggle, under the Runtime rule File system tab.</li><li>To ignore such a detection for a known and allowed process, create a Runtime custom rule that allows these file changes by a specific process</li></ul>                                                                                                                                                                                                                                                                                               | \<process name> changed the binary \<file path>                                                                                                                                                                                                                                |                                                                                                                                        | Containers, App-Embedded             |
| ELF File Access               | <p>Indicates that an ELF file, that is not part of the runtime model, was modified.</p><ul><li>This detection works automatically when using a Container runtime model.</li><li>To disable this detection, disable the <strong>Enable automatic runtime learning</strong> toggle under the <strong>Defend > Runtime > Container policy</strong> tab.</li></ul>                                                                                                                                                                                                                                                                                                             | \<process name> changed the binary \<file path>                                                                                                                                                                                                                                |                                                                                                                                        | Containers, App-Embedded             |
| Secret File Access            | <p>Indicates that a file containing sensitive key material, that is not part of the runtime model, was written.</p><ul><li>This detection works automatically for containers when using a Container runtime model.</li><li>To disable this detection for containers, disable the <strong>Enable automatic runtime learning</strong> toggle under the <strong>Defend > Runtime > Container policy</strong> tab.</li><li>Enable and disable this detection for app-embedded via the Changes to binaries and certificates toggle, under the Runtime rule File system tab.</li></ul>                                                                                           | \<process name> created a key file at \<file path>                                                                                                                                                                                                                             |                                                                                                                                        | Containers, App-Embedded             |
| Regular File Access           | <p>Indicates that a regular file, that is not part of the runtime model, was created.</p><ul><li>This detection works automatically when using a Container runtime model.</li><li>For Serverless, this works when adding the path to the <strong>Denied & fallback</strong> list under File System.</li><li>To disable this detection, disable the <strong>Enable automatic runtime learning</strong> toggle under the <strong>Defend > Runtime > Container policy</strong> tab.</li></ul>                                                                                                                                                                                 | <ul><li>Container: \<process name> wrote suspicious file to \<file path></li><li>Serverless: \<process name> access a suspicious path of \<file path></li></ul>                                                                                                                |                                                                                                                                        | Containers, Serverless, App-Embedded |
| WildFire Malware detection    | <p>Indicates that a file detected by WildFire as malware was written to the file system.</p><p>To enable or disable WildFire:</p><ul><li>Open the <strong>Manage > system > WildFire</strong> page and configure the desired settings</li><li>Open the Runtime rule for Containers, Hosts, or App-Embedded, and enable/disable <strong>Use WildFire malware analysis</strong>. For Container/Host policy, this option is available under <strong>Anti-malware</strong> tab and for App-Embedded policy it’s available under <strong>File system</strong> tab.</li></ul>                                                                                                    | Process \<process name> created the file \<file name> with MD5 \<MD5>. The file created was detected as malicious. Report URL: \<report url>                                                                                                                                   | [Malware](/content-collections/runtime-security/runtime-defense/incident-types/malware.md)                                             | Containers, Hosts, App-Embedded      |
| Unknown Origin Binary         | <p>Indicates that a binary file was written by a process that is not a known OS distribution package manager.</p><ul><li>Enable and disable this detection via the <strong>Non-packaged binaries created or run by user</strong> and <strong>Non-packaged binaries created or run by service</strong> toggles, under the Runtime rule Anti-malware tab.</li><li>To ignore such a detection for a known and allowed process, create a Runtime custom rule that allows these file changes by a specific process</li></ul>                                                                                                                                                    | \<process name> which is not a known OS distribution package manager wrote the binary \<path>                                                                                                                                                                                  |                                                                                                                                        | Hosts                                |
| Web Shell                     | <p>Indicates that a file written to disk was detected as a web shell.</p><ul><li>Enable and disable this detection via the <strong>Webshell attacks</strong> toggle, under the <strong>Host</strong> Runtime rule Anti-malware tab</li><li>To ignore such a detection for a known and allowed process, create a Runtime custom rule that allows these file changes by a specific process</li></ul>                                                                                                                                                                                                                                                                         | \<process name> wrote the file \<file path> that was detected as a web shell.                                                                                                                                                                                                  |                                                                                                                                        | Hosts                                |
| File Integrity                | <p>Indicates that file integrity detection was audited.</p><ul><li>To configure File integrity detections, open the Host runtime rule, navigate to the File integrity tab, and create rules to add specific detections.</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                          |                                                                                                                                                                                                                                                                                |                                                                                                                                        | Hosts                                |
| Malware Downloaded            | <p>Indicates when a binary that has an architecture not supported by PC Compute Defender, is written to disk by a file download utility (“wget”, “curl”, etc.). PC Compute Defender supports the x86\_64 architecture.</p><ul><li>Enable and disable this detection via the <strong>Binaries with suspicious ELF headers</strong> toggle, under the <strong>Containers/App-Embedded</strong> Runtime rule File system tab, or under the <strong>Host</strong> Runtime rule Anti-malware tab.</li><li>To ignore such a detection for a known and allowed process, create a Runtime custom rule that allows these file changes by a specific process</li></ul>               | Suspected malicious ELF file \<file path> downloaded by process \<process name> that is spawned by service \<service name> \[ For interactive audits, should include: \<audit message> and user \<user> ] \<audit message>. Incompatible process architecture \<architecture>. | [Suspicious binary](/content-collections/runtime-security/runtime-defense/incident-types/suspicious-binary.md)                         | Containers, Hosts, App-Embedded      |
| Suspicious ELF Header         | <p>Indicates that an ELF file with suspicious malware indicators in the header was created. The ELF header can indicate that the file was modified with anti-analysis techniques, which is used often by malware to avoid detection.</p><ul><li>Enable and disable this detection via the <strong>Binaries with suspicious ELF headers</strong> toggle, under the <strong>Containers/App-Embedded</strong> Runtime rule File system tab, or under the <strong>Host</strong> Runtime rule Anti-malware tab.</li><li>To ignore such a detection for a known and allowed process, create a Runtime custom rule that allows these file changes by a specific process</li></ul> | Suspected malicious ELF file \<file path>. File headers indicate anti-analysis techniques have been used to modify the file, which is used often by malware to avoid detection.                                                                                                | [Suspicious binary](/content-collections/runtime-security/runtime-defense/incident-types/suspicious-binary.md)                         | Containers, Hosts, App-Embedded      |
| Execution Flow Hijack Attempt | <p>Indicates a possible attempt to hijack program execution flow. For example, an audit will be generated when a process writes to /etc/ld.so.preload.</p><ul><li>Enable and disable this detection via the <strong>Execution flow hijacking</strong> toggle, under the Host Runtime rule Anti-malware tab</li><li>To ignore such a detection for a known and allowed process, create a Runtime custom rule that allows these file changes by a specific process</li></ul>                                                                                                                                                                                                 | Binary \<process name> wrote to \<file path>. File /etc/ld.so.preload is a special Linux system file that impacts the entire system. Libraries specified in this file are preloaded for all programs that are executed in the system.                                          | [Execution flow hijack attempt](/content-collections/runtime-security/runtime-defense/incident-types/execution-flow-hijack-attempt.md) | Hosts                                |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/content-collections/runtime-security/runtime-defense/runtime-audits.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.