Container Defense Evasion via Rapid File Lifecycle

This threat involves a container-based defense evasion technique where an attacker downloads a payload into a transient directory (e.g., /tmp, /dev/shm) using standard utilities like curl or wget. The file is immediately executed and then deleted, a pattern designed to bypass security monitoring and frustrate forensic analysis. This activity is often indicative of post-exploitation phases such as credential theft or lateral movement.

Attack Chain

1. Access is gained to a containerized environment.
2. A shell is opened or an existing process is hijacked.
3. The attacker initiates a download of a malicious payload using utilities such as curl, wget, or rsync.
4. The payload is written to a user-writable path such as /tmp, /dev/shm, or /proc/*/fd/.
5. The downloaded file is executed within the container.
6. The file is deleted shortly after execution to remove the indicator of compromise.

Recommendation

• Deploy detection rules that correlate file creation, process execution, and file deletion events within containers.
• Implement and enforce read-only root filesystems for production containers to prevent the creation of unauthorized binaries in temporary directories.
• Monitor container egress traffic to identify and block connections to unauthorized download hosts or C2 infrastructure.
• Use runtime security tooling to identify and isolate containers exhibiting rapid file lifecycle patterns in sensitive paths.
• Revoke and rotate any secrets, service account tokens, or API keys associated with a container identified in a suspicious file lifecycle event.