Results for “kubernetes-security”
9 skills
mukul975 implementing-runtime-security-with-tetragon
Implement eBPF-based runtime security observability and enforcement in Kubernetes clusters using Cilium Tetragon for kernel-level threat detection and policy enforcement.
24.6k · bundle
mukul975 implementing-ebpf-security-monitoring
Deploy kernel-level runtime security monitoring on Linux hosts or Kubernetes clusters using eBPF and Cilium Tetragon for process execution tracking, network observability, file access auditing, and runtime enforcement.
24.6k · bundle
mukul975 performing-cloud-native-forensics-with-falco
Deploys and manages Falco YAML rules for runtime threat detection in containers and Kubernetes, monitoring syscalls for shell spawns, file tampering, network anomalies, and privilege escalation. Parses Falco alerts for incident response.
24.6k · bundle
More results
mukul975 analyzing-kubernetes-audit-logs
Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access. Builds threat detection rules from audit event patterns.
24.6k · bundle
mukul975 detecting-kerberoasting-attacks
Detect Kerberoasting attacks by monitoring for anomalous Kerberos TGS requests targeting service accounts with SPNs for offline password cracking.
24.6k · bundle
zhaoxuya520 windows-ad
Guides authorized Active Directory security research covering Kerberos attacks, AD CS vulnerabilities, BloodHound path analysis, NTLM relay, and domain privilege escalation techniques.
12.8k · bundle
mukul975 detecting-container-runtime-threats-with-falco
Write and deploy Falco rules with the modern eBPF driver to detect container escape, namespace abuse, privileged mounts, and anomalous syscalls at runtime in Kubernetes and Docker.
24.6k · bundle
mukul975 detecting-container-escape-attempts
Detect container escape attempts using runtime security tools like Falco, Sysdig, and custom seccomp/audit rules.
24.6k · bundle
mukul975 detecting-container-drift-at-runtime
Detect unauthorized modifications to running containers by monitoring for binary execution drift, file system changes, and configuration deviations from the original container image.
24.6k · bundle