Containers - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/containers/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 04 Nov 2026 03:42:34 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgDetection of Unauthorized Process Termination in Containershttps://feed.craftedsignal.io/briefs/2026-11-container-process-killing/Wed, 04 Nov 2026 03:42:34 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-container-process-killing/Adversaries utilize process termination utilities within containers to disrupt security agents, terminate competing processes, or maintain resource dominance.This brief details a detection strategy for identifying the unauthorized use of Linux process-termination utilities within containerized environments. Threat actors commonly enumerate processes and employ commands such as kill, pkill, or killall - often invoked via shell or busybox wrappers - to disable security monitoring tools, web servers, or competing unauthorized tasks (e.g., cryptominers). The detection logic focuses on capturing process execution events originating from within containerized workloads.

Impact

Successful process termination can lead to the loss of visibility into container activity, the disabling of security and monitoring agents, service instability, and the disruption of legitimate business applications.

Recommendation

  • Deploy runtime security monitoring for all containerized workloads to capture process-execution telemetry.
  • Implement the provided detection logic to flag execution of kill, pkill, and killall within containers.
  • Enforce least-privilege configurations for containers, specifically by dropping SYS_PTRACE capabilities and enforcing read-only root filesystems where possible.
  • Restrict interactive container access (exec/attach) using RBAC and just-in-time approval workflows to reduce the surface area for manual process manipulation.
]]>lowadvisorycontainerslinuxthreat-detection