Detects container drift in running Kubernetes workloads by monitoring binary executions, filesystem writes, package installs, and shell spawns using Falco rules.
npx claudepluginhub killvxk/cybersecurity-skills-zhThis skill uses the workspace's default tool permissions.
容器偏移是指运行中的容器通过未授权的文件修改、意外的二进制执行、配置变更或软件包安装，偏离其原始镜像状态的现象。由于容器应被视为不可变基础设施，任何偏移都是潜在的入侵指标。检测技术利用 DIE（检测、隔离、驱逐）模型——不可变工作负载在运行期间不应发生变化，因此任何观察到的变化都可能是恶意活动的证据。
Detects runtime container drift in Kubernetes by monitoring binary execution, filesystem changes, and config deviations using Falco and image comparisons. Useful for security incident response and threat hunting.
Detects runtime container drift in Kubernetes via Falco rules for binary execution, filesystem changes, configuration deviations, and more. For security incident response and threat hunting.
Detects container escape attempts using Falco rules for privileged access, Docker socket mounts, sensitive paths, namespace changes, and auditd in Docker and Kubernetes.
Share bugs, ideas, or general feedback.
容器偏移是指运行中的容器通过未授权的文件修改、意外的二进制执行、配置变更或软件包安装，偏离其原始镜像状态的现象。由于容器应被视为不可变基础设施，任何偏移都是潜在的入侵指标。检测技术利用 DIE（检测、隔离、驱逐）模型——不可变工作负载在运行期间不应发生变化，因此任何观察到的变化都可能是恶意活动的证据。
基于镜像的比对：将运行中容器的文件系统与源镜像进行比较，识别已添加、修改或删除的文件。
行为监控：使用 eBPF 或内核级监控来检测偏离预期行为的进程执行、文件访问和网络活动。
摘要验证：持续验证运行中的容器镜像摘要是否与已批准的部署清单匹配。
- rule: Drift Detected (Container Image Modified Binary)
desc: 检测执行原始容器镜像中不存在的二进制文件
condition: >
spawned_process and
container and
not proc.pname in (container_entrypoint) and
proc.is_exe_upper_layer = true
output: >
检测到偏移：容器中执行了新的二进制文件
(user=%user.name command=%proc.cmdline container=%container.name
image=%container.image.repository:%container.image.tag
exe_path=%proc.exepath)
priority: WARNING
tags: [container, drift]
- rule: Container Shell Spawned
desc: 检测应不可变容器中的交互式 shell
condition: >
spawned_process and
container and
proc.name in (bash, sh, dash, zsh, csh, ksh) and
not proc.pname in (container_entrypoint)
output: >
容器中启动了 shell (user=%user.name shell=%proc.name
container=%container.name image=%container.image.repository)
priority: WARNING
tags: [container, drift, shell]
- rule: Package Manager Execution in Container
desc: 检测包管理器的使用，表明存在偏移
condition: >
spawned_process and
container and
proc.name in (apt, apt-get, yum, dnf, apk, pip, pip3, npm, gem, cargo)
output: >
容器中执行了包管理器 (user=%user.name
command=%proc.cmdline container=%container.name
image=%container.image.repository)
priority: ERROR
tags: [container, drift, package-manager]
- rule: Container File System Write
desc: 检测对容器上层文件系统的写入操作
condition: >
open_write and
container and
fd.typechar = 'f' and
not fd.name startswith /tmp and
not fd.name startswith /var/log and
not fd.name startswith /proc
output: >
容器中发生文件写入 (user=%user.name file=%fd.name
container=%container.name)
priority: NOTICE
tags: [container, drift, filesystem]
通过使容器文件系统不可变来防止偏移：
apiVersion: apps/v1
kind: Deployment
metadata:
name: immutable-app
spec:
template:
spec:
containers:
- name: app
image: app:v1.0@sha256:abc123...
securityContext:
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
runAsNonRoot: true
volumeMounts:
- name: tmp
mountPath: /tmp
- name: cache
mountPath: /var/cache
volumes:
- name: tmp
emptyDir:
sizeLimit: 100Mi
- name: cache
emptyDir:
sizeLimit: 50Mi
apiVersion: v1
kind: Namespace
metadata:
name: production
labels:
pod-security.kubernetes.io/enforce: restricted
pod-security.kubernetes.io/audit: restricted
pod-security.kubernetes.io/warn: restricted
#!/bin/bash
# 将运行中容器的摘要与已批准清单进行比对
NAMESPACE="production"
kubectl get pods -n "$NAMESPACE" -o json | jq -r '
.items[] |
.spec.containers[] |
"\(.image) \(.imageID)"
' | while read IMAGE IMAGE_ID; do
APPROVED_DIGEST=$(kubectl get deploy -n "$NAMESPACE" -o json | \
jq -r ".items[].spec.template.spec.containers[] | select(.image==\"$IMAGE\") | .image")
if [[ "$IMAGE" != *"@sha256:"* ]]; then
echo "[WARN] 容器使用了可变标签: $IMAGE"
fi
done
对于 Azure Kubernetes 环境，Microsoft Defender 提供内置的二进制偏移检测：
{
"alertType": "K8S.NODE_ImageBinaryDrift",
"severity": "Medium",
"description": "执行了原始容器镜像中不存在的二进制文件",
"remediationSteps": [
"调查二进制文件的来源和用途",
"检查容器是否已被入侵",
"从干净镜像重建容器",
"启用 readOnlyRootFilesystem"
]
}