CDR-CRS Process Alerts
Container Runtime Security (CRS) - Threat Detection Guide
Overview
The Container Runtime Security (CRS) Threat Detection Guide provides detailed information about threat detection rules and process monitoring capabilities available across different CRS versions.
This guide helps you:
- Understand supported threats by version
- Review monitored processes and allowlists
- Analyze MITRE ATT&CK coverage
- Select the appropriate version for deployment
Version Summary
| Version | Threat Count |
|---|---|
| 0.9.10 | 14 |
| 0.9.11 | 11 |
A total of 25 supported threats across versions.
Version 0.9.10
Supported Threats
| Sl. no | Threat Name |
|---|---|
| 1 | CryptoMiner Execution |
| 2 | Credential Access Bash History |
| 3 | Network Scanning Utility |
| 4 | Container Escape via Cgroup |
| 5 | Container Escape using Runtime Socket |
| 6 | Clear System Logs |
| 7 | Hidden Process Using Mount |
| 8 | cURL Proxy Usage |
| 9 | Scheduled Cron Jobs |
| 10 | Python Execution with Suspicious Args |
| 11 | Kubernetes Service Account Token Created |
| 12 | Container Escape Using Docker Socket |
| 13 | Stop Antimalware Process |
| 14 | Netcat Reverse Shell Execution |
Process Allowlist (14 Processes)
Common allowed process patterns:
.*\/(bash|cat|curl|docker|grep|kubectl|nc|netcat|python|rm|sh|wget|xmrig)$Version 0.9.11
Supported Threats
| Sl. no | Threat Name |
|---|---|
| 46 | Create Symlink or Hardlink Over Sensitive Files |
| 47 | Default Launched in Privileged Container |
| 48 | Find AWS Credentials |
| 49 | Search Private Keys and Passwords |
| 50 | Reconnaissance Attempt to Identify SUID Binaries |
| 51 | Bind Escape Attempt Using Sock |
| 52 | Dump Memory for Credentials |
| 53 | Kill Runtime Execution |
| 54 | Sudo Privilege Escalation |
| 55 | Usage of Steganography Tools |
| 56 | Polkit Local Privilege Escalation |
Process Allowlist (21 Monitored Processes)
Includes a broader set of utilities such as:
'/*/(curl|wget|clang|bcc|gcc|docker|unshare|mount|kubectl|crictl|modprobe|pnscan|masscan|wpscan|nmap|zgrab|nslookup|netstat|ifconfig|ping|traceroute|route|tcpdump|python|crontab|service|sysctl|rm|nc|ip|arp|debugfs|grep|egrep|fgrep|find|locate|mlocate|gdb|bash|sh|rsync|scp|sftp|dcp|pkexec|find|zip|tar|gzip|hdiutil|7z|sudoedit|sudo|Steghide|Foremost|Stegsolve|Exiftool|Exiv2|Binwalk|Zsteg|Wavsteg|StegCracker|Fcrackzip|ssh|chmod|chown|insmod|dd|devmem|gcore|strace|crash|memdump|fmem|procdump|pmdump|pcredz|mimipenguin|creddump|gsecdump|hashdump|laZagne|volatility|secretsdump|memfetch|avml|ln)$'