https://aegrah.github.io/tags/containers.htmlRecent content in Containers on RGROSECHugo -- gohugo.ioenCopyright © Ruben GroenewoudFri, 20 Mar 2026 12:00:00 +0200https://aegrah.github.io/post/2026-03-20-teampcp-container-attack-scenario.htmlFri, 20 Mar 2026 12:00:00 +0200https://aegrah.github.io/post/2026-03-20-teampcp-container-attack-scenario.html At Elastic Security Labs, I published a real-world walkthrough of TeamPCP's multi-stage container compromise, demonstrating how Elastic's Defend for Containers (D4C) surfaces runtime signals across each stage of the attack chain. Rather than analyzing isolated techniques in abstraction, we follow the attack as it unfolds inside a containerized environment based on the TeamPCP cloud-native ransomware operation documented by Flare. The scenario spans nearly the entire MITRE ATT&CK lifecycle—from initial execution via curl | bash and Kubernetes environment discovery, through lateral movement via kube.https://aegrah.github.io/post/2026-03-19-getting-started-with-defend-for-containers.htmlThu, 19 Mar 2026 12:00:00 +0200https://aegrah.github.io/post/2026-03-19-getting-started-with-defend-for-containers.html At Elastic Security Labs, I published a comprehensive walkthrough of Elastic's Defend for Containers (D4C) integration, covering Kubernetes-based deployment, BPF-enriched runtime telemetry analysis, and the practical application of policy-driven security controls for containerized Linux environments. Defend for Containers arrived in Elastic Stack 9.3.0 as a runtime security integration that captures process execution and file access events enriched with container and orchestration context. This post provides a practical starting point for detection engineers: how to deploy D4C via Elastic Agent in Kubernetes, how its selector-response policy model works, which fields matter for detection logic (capabilities, interactive execution, container privilege context), and how to enable the pre-built detection ruleset.