Goal

Detect the use of kubectl inside a container to access another container.

Strategy

This detection triggers when kubectl is executed with specific arguments related to accessing containers. These arguments include port forwarding and using exec to create a shell.

Triage and response

1. Identify the purpose of the container using tags, such as the image and service tags.
2. Determine the target container using the process arguments.
3. Initiate the incident response process.
4. Remediate compromised resources and repair the root cause.

What happened

A kubectl command was used to access another container, potentially for lateral movement or privilege escalation.

Requires Agent version 7.27 or greater