DEMO
You are viewing a demo with synthetic data.to connect your own infrastructure.

Container Escape Attempt

active
Attacker Type
AI AGENT
Confidence
91%
Kill Chain
Defense Evasion
Events
312
CRS Score
96
Elapsed
45s

EVENT TIMELINE

critical15:50:00

Container escape attempt via CVE-2024-21626

info15:50:02

CIE: Emergency seccomp profiles applied

critical15:50:05

Kubelet API probe detected, access blocked

ATTACK NARRATIVE

An AI agent is conducting a rapid-fire container escape campaign across the Kubernetes cluster. The attacker is cycling through known container escape techniques at machine speed, testing CVE-2024-21626, CVE-2024-23652, and custom eBPF-based escape methods. The CIE has reinforced all container boundaries with runtime seccomp profiles and deployed decoy containers with simulated escape vulnerabilities. The attacker has been redirected into 3 honeypot containers where their complete toolkit is being catalogued.

Affected Assets

k8s-node-prod-01k8s-node-prod-02pod-api-gateway-7f8d9pod-worker-batch-2c4e1

Agent Layers Involved

containerinfranetwork

PREDICTED NEXT MOVES

01Exploit CVE-2024-21626 for container escape
02Access node kubelet API
03Deploy cryptominer DaemonSet

Pre-Blocked Paths

BLOCKEDExploit CVE-2024-21626 for container escape
BLOCKEDAccess node kubelet API
BLOCKEDDeploy cryptominer DaemonSet

COUNTER-ACTIONS EXECUTED

Applied emergency seccomp profiles to all pods
15:50:02
97%
Deployed 3 honeypot containers with fake escape vulns
15:50:10
93%
Blocked kubelet API access from all non-system pods
15:50:05
100%