Linux & Cloud Detection Engineering - TeamPCP Container Attack Scenario

This report presents an applied detection-engineering walkthrough of the TeamPCP cloud-native attack chain (cryptojacking / cloud-native ransomware-associated), tracing stages from initial download-and-execute to Kubernetes discovery, lateral movement using stolen service-account tokens, privileged DaemonSet creation and node-escape attempts, tunneling/proxy deployment, base64-encoded payload execution, and final miner deployment; it maps each stage to D4C runtime telemetry and Kubernetes audit detections, provides detection rules, sample commands/IOCs, and shows how correlated alerts form a coherent attack narrative.