CKSKubernetes 1.35

Exercises

Exercise: find what the compromised Pod is doing

updated 2026-10-22 by seed

Host: worker (root) · Time: 12 min · Domain: Monitoring, Logging and Runtime Security

Task

Pod suspect in prod is mining. You must:

  • Find the process inside the container that is consuming CPU.
  • Show the binary that was executed and the arguments.
  • Write the path of that binary to /root/suspect-binary.txt.

Acceptance criteria

  • The file contains the full path inside the container.
  • You can show the execve line that proves how it started.

Solution

kubectl exec -n prod suspect -- ps aux --sort=-%cpu | head -5
kubectl exec -n prod suspect -- ls -l /proc/1/exe

# from the node, with the real PID
sudo crictl ps | grep suspect            # container id
PID=$(sudo crictl inspect <id> | jq -r '.info.pid')
sudo ps -ef --forest | grep -A3 $PID
sudo strace -f -p $PID -e trace=execve -s 200 2>&1 | head
echo "/usr/bin/xmrig" > /root/suspect-binary.txt

If strace is not permitted inside the Pod, run it on the node against the
container PID — the trace is the same. execve shows the binary and its
arguments, which is what the question is really after.