Container accessed using kubectl in another container
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel,
n'hésitez pas à nous contacter.
Goal
Detect the use of kubectl inside a container to access another container.
Strategy
This detection triggers when kubectl is executed with specific arguments related to accessing containers. These arguments include port forwarding and using exec to create a shell.
Triage and response
- Identify the purpose of the container using tags, such as the image and service tags.
- Determine the target container using the process arguments.
- Initiate the incident response process.
- Remediate compromised resources and repair the root cause.
Requires Agent version 7.27 or greater
