Container accessed using kubectl in another container
이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우
언제든지 연락주시기 바랍니다.Goal
Detect the use of kubectl inside a container to access another container.
Strategy
This detection triggers when kubectl is executed with specific arguments related to accessing containers. These arguments include port forwarding and using exec to create a shell.
Triage and response
- Identify the purpose of the container using tags, such as the image and service tags.
- Determine the target container using the process arguments.
- Initiate the incident response process.
- Remediate compromised resources and repair the root cause.
What happened
A kubectl command was used to access another container, potentially for lateral movement or privilege escalation.
Requires Agent version 7.27 or greater
