Results for “privileged-containers”

Detect container escape attempts using Falco, seccomp, and auditd, with rules for privileged containers, Docker socket access, and kernel module loading.

Exploit privileged pods, host mounts, runC CVEs, and exposed Docker sockets to break out of a container and reach the underlying host during authorized container-security assessments.

Detect and prevent privilege escalation in Kubernetes pods by monitoring security contexts, capabilities, and syscall patterns with Falco and OPA policies.

Provides expertise in containerization technology, covering container creation, orchestration integration, security hardening, and operational best practices for production workloads.

Deploy CyberArk Privileged Access Management to discover, vault, rotate, and monitor privileged credentials across enterprise infrastructure, covering vault architecture, session isolation, credential rotation policies, and NIST 800-53 integration.

Manage container images, artifacts, and repositories in Azure Container Registry using the Python SDK.

Find over-permissive RBAC roles and service-account token abuse paths in Kubernetes using kubectl auth can-i, rbac-police, kubectl-who-can, and rakkess during authorized cluster security reviews.

Apply CIS Docker Benchmark v1.8.0 security best practices to harden Docker containers for production, covering daemon configuration, image building, runtime controls, and auditing.

Least privilege is easy to state and hard to hold: grant each identity only the

Provides guidance and best practices for working with containerd, covering setup, configuration, deployment, and troubleshooting.

Compute, object storage, block storage, a managed relational database, a message

Hardens managed Kubernetes clusters on EKS, AKS, and GKE by implementing Pod Security Standards, network policies, workload identity, RBAC scoping, image admission controls, and runtime security monitoring.

Design and implement Privileged Access Workstations (PAWs) with device hardening, just-in-time access, and integration with CyberArk or BeyondTrust for secure administrative operations.

Enumerate and audit GCP storage buckets and IAM policies using GCPBucketBrute and gcloud CLI to identify privilege escalation paths and overly permissive access.

Enforce Pod Security Standards (Privileged, Baseline, Restricted) in Kubernetes 1.25+ using the Pod Security Admission controller with namespace labels and compliant pod specs.

Audits Azure Storage accounts for misconfigurations including public blob access, weak network rules, missing encryption, permissive SAS tokens, and disabled logging using Azure CLI, PowerShell, and Defender for Storage.

Detect compromised cloud credentials across AWS, Azure, and GCP by analyzing anomalous API activity, impossible travel patterns, unauthorized resource provisioning, and credential abuse indicators using GuardDuty, Defender for Identity, and SCC Event Threat Detection.

Hardens GitHub Actions workflows against supply chain attacks, credential theft, and privilege escalation by pinning actions to SHA digests, minimizing GITHUB_TOKEN permissions, preventing script injection, and implementing workflow change controls.

Builds AWS Nitro Enclave-based confidential computing environments with cryptographic attestation, KMS policy integration, and secure vsock communication for processing sensitive data.

Detect container escape attempts using runtime security tools like Falco, Sysdig, and custom seccomp/audit rules.

Write and deploy Falco rules with the modern eBPF driver to detect container escape, namespace abuse, privileged mounts, and anomalous syscalls at runtime in Kubernetes and Docker.

Centralize secrets management with HashiCorp Vault, including dynamic secret generation, transit encryption, PKI certificate management, and Kubernetes integration.

Audit Kubernetes RBAC configurations to identify overly permissive roles, wildcard permissions, dangerous bindings, service account abuse, and privilege escalation paths using kubectl, rbac-tool, KubiScan, and Kubeaudit.

Cloud security posture assessment for AWS, Azure, and GCP. Tests IAM privilege escalation paths, public storage exposure, serverless attack surface, database exposure, logging gaps, container registry security, and cloud-specific attacks. Both authenticated (with cloud credentials) and unauthenticated (external) modes. Uses nuclei cloud templates, Prowler, ScoutSuite, manual IMDS/metadata probing, and deep AWS/Azure/GCP CLI enumeration. Produces: cloud architecture diagram, attack path map, findings per category, compliance mapping (SOC 2, PCI DSS 4.0, HIPAA, CIS), PoCs for confirmed exploits. Chains into /gh-export for issue filing.

Inventory cryptographic assets, deploy hybrid X25519 and ML-KEM key exchange, and prioritize migration of harvest-now-decrypt-later data.

Identify AWS IAM privilege escalation paths by analyzing policies for dangerous permission combinations and least-privilege violations using boto3 and Cloudsplaining-style analysis.

Containerized security auditing and ethical hacking tools. All operations run in isolated Docker containers for safety.

Docker and container development agent skill and plugin for Dockerfile optimization, docker-compose orchestration, multi-stage builds, and container security hardening. Use when: user wants to optimize a Dockerfile, create or improve docker-compose configurations, implement multi-stage builds, audit container security, reduce image size, or follow container best practices. Covers build performance, layer caching, secret management, and production-ready container patterns.

Post-exploitation workflow. Covers privilege escalation (Linux SUID/sudo/kernel, Windows UAC/service/token), persistence assessment, local enumeration, credential harvesting, and pivot preparation. Structured workflows for Linux and Windows targets using impacket, netexec, john, linpeas/winpeas, and standard Kali tools. Includes kernel exploit reference tables, GTFOBins exploitation chains, Potato attack selection, Docker/container escapes, DLL hijacking, SSH key harvesting, credential recovery from memory, and Windows token manipulation. Chains from /pentester or /credential-audit when access is obtained.

Containeriza aplicaciones con Docker: crea Dockerfiles multi-stage, docker-compose.yml, y manifiestos de Kubernetes, optimiza imágenes y depura contenedores.

Implements container security with image scanning, runtime protection, image signing, and security policies using tools like Falco, Trivy, and Notary.

Diagnoses and operates Kubernetes clusters: pods, deployments, ingress, HPA, PVC, StorageClass, NetworkPolicy, Secrets, Helm, ArgoCD, cert-manager. Reads before changing; mutations require confirmation and diff review.