Potential Container Discovery Via Inodes Listing — Detection Rule

Detects listing of the inodes of the "/" directory to determine if the we are running inside of a container.

Read the full analysis on IntelFusions