diff --git a/rules/integrations/cloud_defend/execution_netcat_listener_established_inside_a_container.toml b/rules/integrations/cloud_defend/execution_netcat_listener_established_inside_a_container.toml
new file mode 100644
index 000000000..822a6c360
--- /dev/null
+++ b/rules/integrations/cloud_defend/execution_netcat_listener_established_inside_a_container.toml
@@ -0,0 +1,59 @@
+[metadata]
+creation_date = "2023/04/26"
+integration = ["cloud_defend"]
+maturity = "production"
+min_stack_comments = "New Integration: Cloud Defend"
+min_stack_version = "8.8.0"
+updated_date = "2023/05/16"
+
+[rule]
+author = ["Elastic"]
+description = "This rule detects an established netcat listener running inside a container. Netcat is a utility used for reading and writing data across network connections, and it can be used for malicious purposes such as establishing a backdoor for persistence or exfiltrating data."
+false_positives = ["""
+  There is a potential for false positives if the container is used for legitimate tasks that require the use of netcat, such as network troubleshooting, testing or system monitoring. It is important to investigate any alerts generated by this rule to determine if they are indicative of malicious activity or part of legitimate container activity.
+  """]
+from = "now-6m"
+index = ["logs-cloud_defend*"]
+interval = "5m"
+language = "eql"
+license = "Elastic License v2"
+name = "Netcat Listener Established Inside A Container"
+risk_score = 73
+rule_id = "a52a9439-d52c-401c-be37-2785235c6547"
+severity = "high"
+tags = ["Elastic", "Host", "Linux", "Threat Detection", "Execution", "Container"]
+timestamp_override = "event.ingested"
+type = "eql"
+
+query = """
+process where container.id: "*" and event.type== "start" 
+and event.action in ("fork", "exec") and 
+(
+process.name:("nc","ncat","netcat","netcat.openbsd","netcat.traditional") or
+/*account for tools that execute utilities as a subprocess, in this case the target utility name will appear as a process arg*/
+process.args: ("nc","ncat","netcat","netcat.openbsd","netcat.traditional")
+) and (
+          /* bind shell to echo for command execution */
+          (process.args:("-*l*", "--listen", "-*p*", "--source-port") and process.args:("-c", "--sh-exec", "-e", "--exec", "echo","$*"))
+          /* bind shell to specific port */
+          or process.args:("-*l*", "--listen", "-*p*", "--source-port")
+          )
+"""
+
+[[rule.threat]]
+framework = "MITRE ATT&CK"
+
+  [rule.threat.tactic]
+  id = "TA0002"
+  reference = "https://attack.mitre.org/tactics/TA0002/"
+  name = "Execution"
+
+  [[rule.threat.technique]]
+  id = "T1059"
+  reference = "https://attack.mitre.org/techniques/T1059/"
+  name = "Command and Scripting Interpreter"
+
+    [[rule.threat.technique.subtechnique]]
+    id = "T1059.004"
+    reference = "https://attack.mitre.org/techniques/T1059/004/"
+    name = "Unix Shell"