container-forensics

What problem does it solve?

This Skill addresses the unique security challenges of containerized environments (Docker and Kubernetes) by providing a systematic approach to forensic investigation, identifying misconfigurations, and detecting potential container escapes.

Core Features & Use Cases

• Environment Detection: Automatically identifies whether the investigation is on a Docker host, Kubernetes cluster, or within a container.
• Comprehensive Auditing: Checks for privileged containers, dangerous flags, exposed sockets, image vulnerabilities, and RBAC misconfigurations in Kubernetes.
• Escape Detection: Looks for indicators of processes breaking out of container isolation.
• Use Case: A security analyst needs to quickly assess a compromised Kubernetes cluster for signs of lateral movement or privilege escalation originating from within a container.

Quick Start

Run container forensics on the current environment.