Kubernetes Forensics — Blog https://www.kubernetesforensics.com/en/blog Latest from Blog en Sun, 27 Sep 2026 20:41:49 GMT What Kubernetes Audit Logs Don't Show (and What Does) https://www.kubernetesforensics.com/en/blog/kubernetes-audit-log-limitations https://www.kubernetesforensics.com/en/blog/kubernetes-audit-log-limitations The blind spots of Kubernetes audit logs: in-container activity, kubelet and etcd access, policy gaps, spoofable fields, and the evidence that fills them. Florian Amette Sun, 27 Sep 2026 00:00:00 GMT Kubernetes Attack Walkthrough: A Fictional Incident https://www.kubernetesforensics.com/en/blog/kubernetes-incident-walkthrough-fictional https://www.kubernetesforensics.com/en/blog/kubernetes-incident-walkthrough-fictional A fictional Kubernetes incident, step by step in the audit log: exposed dashboard token, can-i recon, secret theft, privileged DaemonSet, cluster-admin, XMRig. Florian Amette Thu, 24 Sep 2026 00:00:00 GMT Crypto-Mining in Kubernetes: Detect It in Audit Logs https://www.kubernetesforensics.com/en/blog/kubernetes-cryptomining-detection https://www.kubernetesforensics.com/en/blog/kubernetes-cryptomining-detection Detect crypto-mining in Kubernetes clusters from audit logs: miner images and arguments, unusual registries, CronJob and DaemonSet persistence, and clean-up. Florian Amette Tue, 22 Sep 2026 00:00:00 GMT Privileged Pods and Container Escape: Audit Log Indicators https://www.kubernetesforensics.com/en/blog/privileged-pods-container-escape https://www.kubernetesforensics.com/en/blog/privileged-pods-container-escape Spot container escape preparation in Kubernetes audit logs: privileged pods, hostPID, hostNetwork, hostPath of / or runtime sockets, kube-system DaemonSets. Florian Amette Sat, 19 Sep 2026 00:00:00 GMT Kubernetes RBAC Privilege Escalation: Detect It in Logs https://www.kubernetesforensics.com/en/blog/kubernetes-rbac-privilege-escalation https://www.kubernetesforensics.com/en/blog/kubernetes-rbac-privilege-escalation Find Kubernetes RBAC privilege escalation in audit logs: cluster-admin bindings, escalate, bind and impersonate verbs, impersonated calls, anonymous grants. Florian Amette Thu, 17 Sep 2026 00:00:00 GMT Kubernetes Secrets Access and Service Account Token Theft https://www.kubernetesforensics.com/en/blog/kubernetes-secrets-service-account-token-theft https://www.kubernetesforensics.com/en/blog/kubernetes-secrets-service-account-token-theft Detect Kubernetes secrets theft and stolen service account tokens in audit logs: cluster-wide lists, read bursts, TokenRequest, public-IP replay, can-i recon. Florian Amette Tue, 15 Sep 2026 00:00:00 GMT Detect kubectl exec, attach and port-forward in Audit Logs https://www.kubernetesforensics.com/en/blog/detect-kubectl-exec-port-forward https://www.kubernetesforensics.com/en/blog/detect-kubectl-exec-port-forward How kubectl exec, attach, cp, port-forward and nodes/proxy appear in Kubernetes audit logs, what the command reveals, and how to tell admin work from abuse. Florian Amette Sat, 12 Sep 2026 00:00:00 GMT How to Analyze Kubernetes Audit Logs in Your Browser https://www.kubernetesforensics.com/en/blog/analyze-kubernetes-audit-logs https://www.kubernetesforensics.com/en/blog/analyze-kubernetes-audit-logs Step-by-step Kubernetes audit log analysis with a free in-browser tool: load EKS, GKE, AKS or raw exports, read the verdict, findings, timeline and entities. Florian Amette Thu, 10 Sep 2026 00:00:00 GMT EKS, GKE and AKS Audit Logs: Enable and Export Them https://www.kubernetesforensics.com/en/blog/eks-gke-aks-audit-logs https://www.kubernetesforensics.com/en/blog/eks-gke-aks-audit-logs How to enable and export Kubernetes audit logs on Amazon EKS, Google GKE and Azure AKS: where they live, what the managed policy drops, and the export commands. Florian Amette Tue, 08 Sep 2026 00:00:00 GMT Kubernetes Audit Policy: What to Log for Forensics https://www.kubernetesforensics.com/en/blog/kubernetes-audit-policy-for-forensics https://www.kubernetesforensics.com/en/blog/kubernetes-audit-policy-for-forensics Write a Kubernetes audit policy that captures the evidence an investigation needs (exec, RBAC, workloads, tokens) without logging secrets or drowning in noise. Florian Amette Sat, 05 Sep 2026 00:00:00 GMT Kubernetes Audit Log Format: Anatomy of an Audit Event https://www.kubernetesforensics.com/en/blog/kubernetes-audit-event-anatomy https://www.kubernetesforensics.com/en/blog/kubernetes-audit-event-anatomy Field-by-field guide to the Kubernetes audit log format: stages, levels, user, sourceIPs, objectRef, responseStatus, annotations, and what matters in forensics. Florian Amette Thu, 03 Sep 2026 00:00:00 GMT Kubernetes Incident Response with API Server Audit Logs https://www.kubernetesforensics.com/en/blog/kubernetes-incident-response-audit-logs https://www.kubernetesforensics.com/en/blog/kubernetes-incident-response-audit-logs A practitioner's Kubernetes incident response guide: the audit log evidence to collect, the questions to answer, the attack patterns to hunt and how to contain. Florian Amette Tue, 01 Sep 2026 00:00:00 GMT