<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-container-runtime-incidents
description: >-
  Investigate container security incidents including escape attempts and supply chain compromises.
domain: cybersecurity
subdomain: cloud-forensics
tags:
  - container
  - docker
  - runtime-security
  - forensics
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1610"]
---

# Analyzing Container Runtime Incidents

## Overview

Investigate container security incidents including escape attempts and supply chain compromises.

## Prerequisites

| Requirement | Install |
|---|---|
| Docker/containerd | Container runtime |
| Falco | Runtime security |
| Python 3.10+ | For agent tooling |

## Key Concepts

Container incident investigation covers runtime events, image
layer inspection, network activity, and escape detection.

## Quick Reference

```bash
docker inspect <container_id>
node agent.js inspect --container abc123 --checks filesystem,network
node agent.js image-audit --image nginx:latest
node agent.js report --investigation CONT-2026-001
```

## Workflow

1. Capture container state
2. Inspect filesystem
3. Analyze network
4. Review processes
5. Audit image
6. Check escape indicators
7. Document

## Detection

```yaml
title: Container Runtime Incidents Detection
id: 47f82379-af62-4539-886e-0c3914aab903
status: experimental
description: Detects suspicious activity related to analyzing container runtime incidents techniques in cloud forensics context
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: high
tags:
  - attack.t1610
  - attack.collection
falsepositives:
  - Scheduled compliance scanning by authorized security tools
```

## Verification

- Verify state capture
- Confirm filesystem analysis
- Validate network inspection
- Check image audit
- Verify evidence

## References

- OWASP Testing Guide — https://owasp.org/www-project-web-security-testing-guide/
- MITRE ATT&CK — https://attack.mitre.org/
- NIST SP 800-53 — https://csf.tools/reference/nist-sp-800-53/
