Update defense_evasion_potential_kubectl_impersonation.toml

Aegrah · web-flow · commit c00d8ea14435 · 2025-06-19T11:36:06.000+02:00
diff --git a/rules/linux/defense_evasion_potential_kubectl_impersonation.toml b/rules/linux/defense_evasion_potential_kubectl_impersonation.toml
@@ -60,6 +60,7 @@ tags = [
     "OS: Linux",
     "Use Case: Threat Detection",
     "Tactic: Defense Evasion",
+    "Tactic: Discovery",
     "Data Source: Elastic Endgame",
     "Data Source: Elastic Defend",
     "Data Source: Auditd Manager",
