A team needs an alert when an unexpected shell executes inside a production container. Which capability directly targets this runtime behavior?

1. A ConfigMap storing a list of approved colors
2. A PVC storage-class annotation
3. A runtime detection rule that evaluates relevant process or syscall events
4. A Service selector for all running Pods