Tracee Newly Released Rules Detect Attackers Out-of-the-Box

Aqua Nautilus announces new and updated Tracee runtime detection signatures for Linux and container environments that map to MITRE ATT&CK techniques. The release highlights signatures for initial access (e.g., web server spawning a shell), privilege escalation and container escape (cgroups, docker.sock, kcore, kernel modules), persistence (cron, LD_PRELOAD, rcd), and defense evasion (proc/syscall hooking, fileless execution, anti‑debugging), intended to provide out‑of‑the‑box runtime detection of attacker behaviors based on Aqua's threat research.