Secure containers from code to runtime | Microsoft Defender

So let me walk you through a multi-stage attack across a containerized environment to show you this in action from the perspective of a SOC analyst.

I'm in Microsoft Defender in the Incidents view, Filter to Container-Related Incidents, and I can see four related containers.

Let's start with this one, a multi-stage incident involving multiple users.

And notice this is already correlated into a single incident, not multiple alerts.

You can see it's flagged as high impact with a critical asset label and the crown icon in the incident graph showing asset criticality.

On the left is the attack story with alerts listed in chronological order, color coded by severity.

If we go back to the incident graph, container resources are in black and related identities and services are in white.

This is runtime threat detection correlated across layers.

In this case, Defender has detected 19 alerts for this incident in near real time and stitched them into a single timeline.

So let's walk through the attack.

Here we can see the initial access signal was from a Kubernetes API request from a proxy IP address.

Identity compromise and escalation then occurred with credentials accessed from a service principle.

And finally, Defender for Cloud's cross-cloud correlation surfaces lateral movements spanning environments, revealing a brute force attack originating from an exposed Azure Kubernetes cluster targeting an AWS relational database service resource.

Back in the graph, you'll notice a blue icon.

This indicates there are related attack paths.

And if we ungroup similar nodes, we see a user indicated by another blue icon and we can pivot directly into the attack path view.

Here's where it gets interesting.

This is where we connect runtime activity back to security posture and exposure.

It's concluded that the container is internet exposed with high severity vulnerabilities and it's using a managed identity to access a protected storage account.

We'll come back to this in a moment to see if we can fix the root cause.

So we can see this wasn't just an isolated runtime event.

There was a clear path from exposure to exploitation.