container-forensics

Investigate container escape indicators by auditing Kubernetes RBAC configurations, checking for privileged containers, and scanning for dangerous flags. This process identifies processes breaking out of container isolation to detect lateral movement or privilege escalation.

Perform Docker forensics by auditing the container inventory and checking for exposed sockets, image vulnerabilities, and privilege escalation vectors. This systematically identifies misconfigurations and potential compromises on the host.

Yes, you can audit Kubernetes RBAC configurations during a container security incident. The investigation checks RBAC settings alongside container escape indicators to detect lateral movement originating from within a compromised container.

Container forensics works on both Docker hosts and Kubernetes clusters by automatically detecting the environment. It audits container inventory, privilege escalation vectors, and image integrity regardless of whether the environment is a Docker host or a Kubernetes cluster.

You need Bash, Read, Write, Glob, and Grep tools to run a forensic investigation of a containerized environment. These tools execute the environment detection, comprehensive auditing, and escape detection checks.

Check for privileged containers during a Docker security audit when investigating potential compromises. Auditing for privileged containers, dangerous flags, and exposed sockets identifies misconfigurations that allow threat actors to escalate privileges or escape isolation.