Unusual Process Spawned by Nginx in Ingress-Nginx pod

Cortex XSIAM Analytics Alert Reference by Alert name

Product

Cortex XSIAM

Last date published

2025-12-08

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: XDR Agent
Detection Modules
Detector Tags	Kubernetes - AGENT, Containers
ATT&CK Tactic	Execution (TA0002) Initial Access (TA0001)
ATT&CK Technique	Command and Scripting Interpreter (T1059) Exploit Public-Facing Application (T1190)
Severity	Low

Unusual Process Spawned by Nginx in Ingress-Nginx pod.

An attacker attempts to use nginx for lateral movement or privilege escalation.

Investigate the child processes for malicious activity and network connections to an external host.

ATT&CK Tactic

ATT&CK Technique

Severity

High

Unusual Process Spawned by Nginx in Ingress-Nginx pod.

An attacker attempts to use nginx for lateral movement or privilege escalation.

Investigate the child processes for malicious activity and network connections to an external host.