<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-container-forensics
description: >-
  Implement container forensics procedures for incident response including
  evidence preservation, filesystem analysis, memory capture, log collection,
  and timeline reconstruction for ephemeral container environments.
domain: cybersecurity
subdomain: container-security
tags:
  - forensics
  - incident-response
  - evidence-preservation
  - timeline
  - memory-analysis
  - container-runtime
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1610"]
---

# Implementing Container Forensics

## Overview

Container forensics is uniquely challenging because containers are ephemeral —
evidence disappears when they restart. This skill covers evidence preservation
procedures (export before anything else), filesystem analysis for IOCs, process
and network state capture, Kubernetes event correlation, and timeline
reconstruction using Falco events, audit logs, and filesystem timestamps.

Mode: `[MODE: INCIDENT]` — Incident response evidence collection.

## Prerequisites

| Requirement | Details |
|---|---|
| Docker or containerd CLI for container inspection | Required |
| crictl for CRI-compatible runtimes | Required |
| kubectl with cluster-admin access | Required |
| Sysdig or Falco for event capture | Required |

## Key Concepts

### Evidence Preservation

```bash
# CRITICAL: Do NOT delete or restart the container before collection

# 1. Capture container metadata
docker inspect CONTAINER_ID > evidence/container_metadata.json
docker logs CONTAINER_ID > evidence/container_logs.txt 2>&1

# 2. Export container filesystem
docker export CONTAINER_ID > evidence/container_fs.tar

# 3. Commit container as image (preserves layers)
docker commit CONTAINER_ID evidence/compromised:$(date +%s)

# 4. Capture process state
docker exec CONTAINER_ID ps auxwww > evidence/processes.txt
docker exec CONTAINER_ID ss -tlnp > evidence/listening_ports.txt
```

### Kubernetes Evidence Collection

```bash
kubectl get pod POD -n NAMESPACE -o yaml > evidence/pod_spec.yaml
kubectl describe pod POD -n NAMESPACE > evidence/pod_describe.txt
kubectl get events -n NAMESPACE --field-selector involvedObject.name=POD > evidence/events.txt
kubectl logs POD -n NAMESPACE --all-containers > evidence/pod_logs.txt
kubectl logs POD -n NAMESPACE --all-containers --previous > evidence/pod_logs_previous.txt 2>/dev/null
```

### Filesystem Analysis

```bash
# Extract and analyze
mkdir -p /tmp/forensics/rootfs
tar -xf evidence/container_fs.tar -C /tmp/forensics/rootfs

# Find recently modified files
find /tmp/forensics/rootfs -type f -mmin -60 -ls > evidence/recent_files.txt

# Find SUID/SGID binaries
find /tmp/forensics/rootfs -perm /6000 -type f -ls > evidence/suid_sgid.txt

# Check for suspicious scripts
find /tmp/forensics/rootfs -name "*.sh" -o -name "*.py" | xargs md5sum > evidence/script_hashes.txt
```

### Timeline Reconstruction

```bash
# Build filesystem timeline
find /tmp/forensics/rootfs -printf '%T@ %m %u %g %s %p\n' | sort -n > evidence/timeline.txt

# Correlate with Falco events
cat /var/log/falco/events.json | jq 'select(.rule | test(".*"))' > evidence/falco_timeline.json
```

## Workflow

### Step 1: Preserve Evidence (Do First)

```bash
node scripts/agent.js --collect --container-id CONTAINER_ID \
  --evidence-dir /tmp/evidence --output /tmp/forensics-report.json
```

### Step 2: Analyze Filesystem

```bash
node scripts/agent.js --analyze-fs --evidence-dir /tmp/evidence \
  --output /tmp/fs-analysis.json
```

## Detection

```yaml
title: Container Forensics Detection
id: 74b617fa-377c-494b-ba21-12d5a4d3f092
status: experimental
description: Detects suspicious activity related to implementing container forensics techniques in container security context
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1610
  - attack.execution
falsepositives:
  - Container orchestration platform performing routine health checks
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Container Forensics Detection | kubernetes | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1610 |

## Verification

- [ ] Container filesystem exported before any modification
- [ ] Container metadata captured (inspect, logs, processes)
- [ ] Network connections recorded at time of capture
- [ ] Kubernetes events and pod specifications preserved
- [ ] Chain of custody documented with timestamps and hashes
- [ ] SHA-256 hashes computed for all evidence artifacts

## References

- [NIST SP 800-86 — Guide to Integrating Forensic Techniques](https://csrc.nist.gov/publications/detail/sp/800-86/final)
- [Docker Forensics — Container Investigation](https://docs.docker.com/engine/reference/commandline/export/)
- [Kubernetes Forensics with kubectl debug](https://kubernetes.io/docs/tasks/debug/debug-cluster/kubectl-node-debug/)
- [Sysdig Container Forensics](https://sysdig.com/blog/container-forensics/)
- [NIST SP 800-190 §4.5 — Container Incident Response](https://csrc.nist.gov/publications/detail/sp/800-190/final)
