An unusual process in ingress-nginx has accessed a service-account token file

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2025-12-08

Activation Period	14 Days
Training Period	30 Days
Test Period	1 Hour
Deduplication Period	1 Day
Required Data	Requires: XDR Agent with eXtended Threat Hunting (XTH)
Detection Modules	Cloud
Detector Tags	Kubernetes - AGENT, Containers
ATT&CK Tactic	Initial Access (TA0001) Credential Access (TA0006)
ATT&CK Technique	Exploit Public-Facing Application (T1190) Unsecured Credentials (T1552)
Severity	High

An unusual process in ingress-nginx has read a service-account token.

An attacker is attempting to gain unauthorized access by leveraging valid credentials.