[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71CJ2NZHTGGF42TPVCME8CD":3,"skill-same:01M71CJ2NZHTGGF42TPVCME8CD":94},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":67,"commitSha":68,"skillDirectory":69,"forksCount":14,"repositoryHtmlUrl":70,"repositoryHomepageUrl":6,"ownerHtmlUrl":71,"ownerBlogUrl":6,"ownerDescription":72,"updatedAt":73,"install":74,"resources":87},"01M71CJ2NZHTGGF42TPVCME8CD","forensics-docker-detect",null,"Investigate compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts to identify malicious activity and evidence.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fforensics\u002Fdocker\u002Fdetect\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000016","图像与多媒体",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"docker","detect","forensics","forensics docker detect","digital-forensics","activity","analyzing","read","runtime-investigation","image-analysis","container-security","de","container-forensics","malicious","logs","analysis","Bash","image","cybersecurity","images","2026-11-10 10:12:30",false,"---\nname: forensics-docker-detect\ndescription: Investigate compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts to identify malicious activity and evidence.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags:\n- forensics\n- docker\n- container-forensics\n- container-security\n- image-analysis\n- runtime-investigation\nnist_csf:\n- RS.AN-01\n- RS.AN-03\n- DE.AE-02\n- RS.MA-01\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1610\ncapec: []\n---\n\n# Analyzing Docker Container Forensics\n\n## When to Use\n- When investigating a compromised Docker container or container host\n- For analyzing malicious Docker images pulled from registries\n- During incident response involving containerized application breaches\n- When examining container escape attempts or privilege escalation\n- For auditing container configurations and identifying misconfigurations\n\n## Prerequisites\n- Docker CLI access on the forensic workstation\n- Access to the Docker host file system (forensic image or live)\n- Understanding of Docker layered file system (overlay2, aufs)\n- dive, docker-explorer, or container-diff for image analysis\n- Knowledge of Docker daemon configuration and socket security\n- Trivy or Grype for vulnerability scanning of container images\n\n## Workflow\n\n### Step 1: Preserve Container State and Evidence\n\n```bash\n# List all containers (including stopped)\ndocker ps -a --no-trunc > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_list.txt\n\n# Inspect the compromised container\nCONTAINER_ID=\"abc123def456\"\ndocker inspect $CONTAINER_ID > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_inspect.json\n\n# Export container filesystem as tarball (preserves current state)\ndocker export $CONTAINER_ID > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_export.tar\n\n# Create an image from the container's current state\ndocker commit $CONTAINER_ID forensic-evidence:case-2024-001\ndocker save forensic-evidence:case-2024-001 > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_image.tar\n\n# Capture container logs\ndocker logs $CONTAINER_ID --timestamps > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_logs.txt 2>&1\n\n# Capture running processes (if container is still running)\ndocker top $CONTAINER_ID > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_processes.txt\n\n# Capture network connections\ndocker exec $CONTAINER_ID netstat -tlnp 2>\u002Fdev\u002Fnull > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_network.txt\n\n# Copy specific files from the container\ndocker cp $CONTAINER_ID:\u002Fvar\u002Flog\u002F \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_var_log\u002F\ndocker cp $CONTAINER_ID:\u002Ftmp\u002F \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_tmp\u002F\ndocker cp $CONTAINER_ID:\u002Fetc\u002Fpasswd \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_passwd\n\n# Hash all exported evidence\nsha256sum \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002F*.tar > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fevidence_hashes.txt\n```\n\n### Step 2: Analyze Container Image Layers\n\n```bash\n# Install dive for image layer analysis\nwget https:\u002F\u002Fgithub.com\u002Fwagoodman\u002Fdive\u002Freleases\u002Flatest\u002Fdownload\u002Fdive_linux_amd64.deb\nsudo dpkg -i dive_linux_amd64.deb\n\n# Analyze image layers interactively\ndive forensic-evidence:case-2024-001\n\n# Non-interactive layer analysis\ndive forensic-evidence:case-2024-001 --ci --json \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fdive_analysis.json\n\n# Extract and examine individual layers\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Flayers\u002F\ntar -xf \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_image.tar -C \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Flayers\u002F\n\n# List the image manifest and layer order\ncat \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Flayers\u002Fmanifest.json | python3 -m json.tool\n\n# Examine each layer for changes\nfor layer in \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Flayers\u002F*\u002Flayer.tar; do\n    echo \"=== Layer: $(dirname $layer | xargs basename) ===\"\n    tar -tf \"$layer\" | head -20\n    echo \"...\"\ndone\n\n# Use container-diff to compare with original base image\n# Install container-diff\ncurl -LO https:\u002F\u002Fstorage.googleapis.com\u002Fcontainer-diff\u002Flatest\u002Fcontainer-diff-linux-amd64\nchmod +x container-diff-linux-amd64\n\n# Compare committed image with original\n.\u002Fcontainer-diff-linux-amd64 diff daemon:\u002F\u002Fnginx:latest daemon:\u002F\u002Fforensic-evidence:case-2024-001 \\\n   --type=file --type=apt --type=history --json \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_diff.json\n```\n\n### Step 3: Examine Docker Host Artifacts\n\n```bash\n# Docker data directory (default: \u002Fvar\u002Flibs\u002Fdocker\u002F)\nDOCKER_ROOT=\"\u002Fmnt\u002Fevidence\u002Fvar\u002Flib\u002Fdocker\"\n\n# Examine overlay2 filesystem layers\nls -la $DOCKER_ROOT\u002Foverlay2\u002F\n\n# Find the container's merged filesystem\nCONTAINER_HASH=$(docker inspect $CONTAINER_ID --format '{{.GraphDriver.Data.MergedDir}}' 2>\u002Fdev\u002Fnull)\n# Or manually from forensic image:\n# Look in \u002Fvar\u002Flibs\u002Fdocker\u002Fcontainers\u002F\u003Ccontainer_id>\u002Fconfig.v2.json\n\n# Analyze container configuration files\ncat $DOCKER_ROOT\u002Fcontainers\u002F$CONTAINER_ID\u002Fconfig.v2.json | python3 -m json.tool \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_config.json\n\n# Check Docker daemon configuration\ncat \u002Fmnt\u002Fevidence\u002Fetc\u002Fdocker\u002Fdaemon.json 2>\u002Fdev\u002Fnull > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fdaemon_config.json\n\n# Examine Docker events log\ncat $DOCKER_ROOT\u002Fcontainers\u002F$CONTAINER_ID\u002F*.log > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_json_logs.txt\n\n# Check for volume mounts (potential host filesystem access)\npython3 \u003C\u003C 'PYEOF'\nimport json\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_inspect.json') as f:\n    data = json.load(f)\n\ninspect = data[0] if isinstance(data, list) else data\n\nprint(\"=== CONTAINER SECURITY ANALYSIS ===\\n\")\n\n# Check mounts\nprint(\"Volume Mounts:\")\nfor mount in inspect.get('Mounts', []):\n    rw = \"READ-WRITE\" if mount.get('RW') else \"READ-ONLY\"\n    print(f\"  {mount.get('Source', 'N\u002FA')} -> {mount.get('Destination', 'N\u002FA')} ({rw})\")\n    if mount.get('Source') in ('\u002F', '\u002Fetc', '\u002Fvar', '\u002Froot') and mount.get('RW'):\n        print(f\"    WARNING: Sensitive host path mounted read-write!\")\n\n# Check privileged mode\nhost_config = inspect.get('HostConfig', {})\nif host_config.get('Privileged'):\n    print(\"\\nWARNING: Container was running in PRIVILEGED mode!\")\n\n# Check capabilities\ncap_add = host_config.get('CapAdd', [])\nif cap_add:\n    print(f\"\\nAdded Capabilities: {cap_add}\")\n    dangerous_caps = ['SYS_ADMIN', 'SYS_PTRACE', 'NET_ADMIN', 'SYS_MODULE']\n    for cap in cap_add:\n        if cap in dangerous_caps:\n            print(f\"  WARNING: Dangerous capability: {cap}\")\n\n# Check PID namespace\nif host_config.get('PidMode') == 'host':\n    print(\"\\nWARNING: Container shares host PID namespace!\")\n\n# Check network mode\nif host_config.get('NetworkMode') == 'host':\n    print(\"\\nWARNING: Container shares host network namespace!\")\n\n# Check user\nuser = inspect.get('Config', {}).get('User', 'root (default)')\nprint(f\"\\nRunning as user: {user}\")\n\n# Check environment variables for secrets\nenv_vars = inspect.get('Config', {}).get('Env', [])\nprint(f\"\\nEnvironment Variables: {len(env_vars)}\")\nfor env in env_vars:\n    key = env.split('=')[0]\n    if any(s in key.upper() for s in ['PASSWORD', 'SECRET', 'KEY', 'TOKEN', 'CREDENTIAL']):\n        print(f\"  SENSITIVE: {key}=***REDACTED***\")\nPYEOF\n```\n\n### Step 4: Analyze Container File System Changes\n\n```bash\n# Compare container filesystem to original image\ndocker diff $CONTAINER_ID > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Ffilesystem_changes.txt\n\n# A = Added, C = Changed, D = Deleted\n# Analyze changes\npython3 \u003C\u003C 'PYEOF'\nadded = []\nchanged = []\ndeleted = []\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Ffilesystem_changes.txt') as f:\n    for line in f:\n        line = line.strip()\n        if line.startswith('A '):\n            added.append(line[2:])\n        elif line.startswith('C '):\n            changed.append(line[2:])\n        elif line.startswith('D '):\n            deleted.append(line[2:])\n\nprint(f\"Files Added: {len(added)}\")\nprint(f\"Files Changed: {len(changed)}\")\nprint(f\"Files Deleted: {len(deleted)}\")\n\n# Flag suspicious additions\nsuspicious = [f for f in added if any(s in f for s in\n    ['\u002Ftmp\u002F', '\u002Fdev\u002Fshm\u002F', '\u002Froot\u002F', '.sh', '.py', '.elf', 'reverse', 'shell', 'backdoor'])]\nif suspicious:\n    print(f\"\\nSuspicious Added Files:\")\n    for f in suspicious:\n        print(f\"  {f}\")\n\n# Flag suspicious changes\nsus_changed = [f for f in changed if any(s in f for s in\n    ['\u002Fetc\u002Fpasswd', '\u002Fetc\u002Fshadow', '\u002Fetc\u002Fcrontab', '\u002Fetc\u002Fssh', '.bashrc'])]\nif sus_changed:\n    print(f\"\\nSuspicious Changed Files:\")\n    for f in sus_changed:\n        print(f\"  {f}\")\nPYEOF\n\n# Extract and examine the container export\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_fs\u002F\ntar -xf \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_export.tar -C \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_fs\u002F\n\n# Scan for webshells and malicious files\nfind \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_fs\u002Ftmp\u002F -type f -exec file {} \\;\nfind \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_fs\u002F -name \"*.php\" -newer \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_fs\u002Fetc\u002Fhostname\n```\n\n### Step 5: Scan for Vulnerabilities and Generate Report\n\n```bash\n# Scan the image for known vulnerabilities\ntrivy image forensic-evidence:case-2024-001 \\\n   --format json \\\n   --output \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fvulnerability_scan.json\n\n# Scan the exported filesystem\ntrivy fs \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_fs\u002F \\\n   --format table \\\n   --output \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Ffs_vulnerabilities.txt\n\n# Check for secrets in the image\ntrivy image forensic-evidence:case-2024-001 \\\n   --scanners secret \\\n   --format json \\\n   --output \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fsecrets_scan.json\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Image layers | Read-only filesystem layers stacked to form the container image |\n| overlay2 | Default Docker storage driver using union filesystem for layers |\n| Container diff | Comparison of runtime filesystem changes against the original image |\n| Privileged mode | Container with full host capabilities (bypasses most isolation) |\n| Docker socket | Unix socket (\u002Fvar\u002Frun\u002Fdocker.sock) controlling the Docker daemon |\n| Container escape | Technique for breaking out of container isolation to the host |\n| Volume mounts | Host filesystem paths made accessible inside the container |\n| Image history | Record of Dockerfile instructions used to build each layer |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| docker inspect | Detailed container configuration and state information |\n| docker diff | Show filesystem changes made in a running\u002Fstopped container |\n| dive | Interactive Docker image layer analysis tool |\n| container-diff | Google tool for comparing container image contents |\n| Trivy | Vulnerability scanner for container images and filesystems |\n| docker-explorer | Forensic tool for offline Docker artifact analysis |\n| Sysdig | Container runtime security monitoring and forensics |\n| Falco | Runtime threat detection for containers and Kubernetes |\n\n## Common Scenarios\n\n**Scenario 1: Web Application Container Compromise**\nExport the container filesystem, identify webshells in web root, analyze access logs for exploitation attempts, check for added files and modified configurations, examine network connections for C2 communication, review container capabilities for escalation paths.\n\n**Scenario 2: Supply Chain Attack via Malicious Image**\nAnalyze image layers with dive to identify which layer added malicious content, compare with the official base image using container-diff, check image history for suspicious RUN commands, scan for embedded backdoors and cryptocurrency miners, trace the image pull from registry logs.\n\n**Scenario 3: Container Escape Investigation**\nCheck if container ran privileged or with dangerous capabilities, examine host filesystem mount points for unauthorized access, review Docker socket mount enabling Docker-in-Docker abuse, analyze host system logs for container escape indicators, check for kernel exploit artifacts.\n\n**Scenario 4: Cryptojacking in Container Environment**\nIdentify high-CPU containers, export and analyze the container image for mining binaries, check for unauthorized images in the registry, review container creation events for rogue deployments, examine network connections for mining pool communications.\n\n## Output Format\n\n```\nDocker Container Forensics Summary:\n  Container: abc123def456 (nginx-app)\n  Image: company\u002Fweb-app:v2.1\n  Status: Running (started 2024-01-10 09:00 UTC)\n  Host: docker-host-01.corp.local\n\n  Security Configuration:\n    Privileged: No\n    Capabilities Added: NET_ADMIN (WARNING)\n    Volume Mounts: \u002Fvar\u002Flog -> \u002Fhost-logs (RW)\n    Network Mode: bridge\n    User: root (WARNING)\n\n  Filesystem Changes:\n    Added: 23 files (5 suspicious)\n    Changed: 12 files (2 suspicious)\n    Deleted: 0 files\n\n  Suspicious Findings:\n    \u002Ftmp\u002Freverse.sh - Reverse shell script (Added)\n    \u002Fvar\u002Fwww\u002Fhtml\u002F.hidden\u002Fshell.php - PHP webshell (Added)\n    \u002Fetc\u002Fcrontab - Modified (persistence cron entry added)\n    \u002Froot\u002F.ssh\u002Fauthorized_keys - Modified (unauthorized key added)\n\n  Vulnerability Scan:\n    Critical: 3 (CVE-2024-xxxx in base image)\n    High: 12\n    Medium: 34\n\n  Evidence: \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002F\n```\n","# Analyzing Docker Container Forensics\n\n## When to Use\n- When investigating a compromised Docker container or container host\n- For analyzing malicious Docker images pulled from registries\n- During incident response involving containerized application breaches\n- When examining container escape attempts or privilege escalation\n- For auditing container configurations and identifying misconfigurations\n\n## Prerequisites\n- Docker CLI access on the forensic workstation\n- Access to the Docker host file system (forensic image or live)\n- Understanding of Docker layered file system (overlay2, aufs)\n- dive, docker-explorer, or container-diff for image analysis\n- Knowledge of Docker daemon configuration and socket security\n- Trivy or Grype for vulnerability scanning of container images\n\n## Workflow\n\n### Step 1: Preserve Container State and Evidence\n\n```bash\n# List all containers (including stopped)\ndocker ps -a --no-trunc > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_list.txt\n\n# Inspect the compromised container\nCONTAINER_ID=\"abc123def456\"\ndocker inspect $CONTAINER_ID > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_inspect.json\n\n# Export container filesystem as tarball (preserves current state)\ndocker export $CONTAINER_ID > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_export.tar\n\n# Create an image from the container's current state\ndocker commit $CONTAINER_ID forensic-evidence:case-2024-001\ndocker save forensic-evidence:case-2024-001 > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_image.tar\n\n# Capture container logs\ndocker logs $CONTAINER_ID --timestamps > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_logs.txt 2>&1\n\n# Capture running processes (if container is still running)\ndocker top $CONTAINER_ID > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_processes.txt\n\n# Capture network connections\ndocker exec $CONTAINER_ID netstat -tlnp 2>\u002Fdev\u002Fnull > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_network.txt\n\n# Copy specific files from the container\ndocker cp $CONTAINER_ID:\u002Fvar\u002Flog\u002F \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_var_log\u002F\ndocker cp $CONTAINER_ID:\u002Ftmp\u002F \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_tmp\u002F\ndocker cp $CONTAINER_ID:\u002Fetc\u002Fpasswd \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_passwd\n\n# Hash all exported evidence\nsha256sum \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002F*.tar > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fevidence_hashes.txt\n```\n\n### Step 2: Analyze Container Image Layers\n\n```bash\n# Install dive for image layer analysis\nwget https:\u002F\u002Fgithub.com\u002Fwagoodman\u002Fdive\u002Freleases\u002Flatest\u002Fdownload\u002Fdive_linux_amd64.deb\nsudo dpkg -i dive_linux_amd64.deb\n\n# Analyze image layers interactively\ndive forensic-evidence:case-2024-001\n\n# Non-interactive layer analysis\ndive forensic-evidence:case-2024-001 --ci --json \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fdive_analysis.json\n\n# Extract and examine individual layers\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Flayers\u002F\ntar -xf \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_image.tar -C \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Flayers\u002F\n\n# List the image manifest and layer order\ncat \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Flayers\u002Fmanifest.json | python3 -m json.tool\n\n# Examine each layer for changes\nfor layer in \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Flayers\u002F*\u002Flayer.tar; do\n    echo \"=== Layer: $(dirname $layer | xargs basename) ===\"\n    tar -tf \"$layer\" | head -20\n    echo \"...\"\ndone\n\n# Use container-diff to compare with original base image\n# Install container-diff\ncurl -LO https:\u002F\u002Fstorage.googleapis.com\u002Fcontainer-diff\u002Flatest\u002Fcontainer-diff-linux-amd64\nchmod +x container-diff-linux-amd64\n\n# Compare committed image with original\n.\u002Fcontainer-diff-linux-amd64 diff daemon:\u002F\u002Fnginx:latest daemon:\u002F\u002Fforensic-evidence:case-2024-001 \\\n   --type=file --type=apt --type=history --json \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_diff.json\n```\n\n### Step 3: Examine Docker Host Artifacts\n\n```bash\n# Docker data directory (default: \u002Fvar\u002Flibs\u002Fdocker\u002F)\nDOCKER_ROOT=\"\u002Fmnt\u002Fevidence\u002Fvar\u002Flib\u002Fdocker\"\n\n# Examine overlay2 filesystem layers\nls -la $DOCKER_ROOT\u002Foverlay2\u002F\n\n# Find the container's merged filesystem\nCONTAINER_HASH=$(docker inspect $CONTAINER_ID --format '{{.GraphDriver.Data.MergedDir}}' 2>\u002Fdev\u002Fnull)\n# Or manually from forensic image:\n# Look in \u002Fvar\u002Flibs\u002Fdocker\u002Fcontainers\u002F\u003Ccontainer_id>\u002Fconfig.v2.json\n\n# Analyze container configuration files\ncat $DOCKER_ROOT\u002Fcontainers\u002F$CONTAINER_ID\u002Fconfig.v2.json | python3 -m json.tool \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_config.json\n\n# Check Docker daemon configuration\ncat \u002Fmnt\u002Fevidence\u002Fetc\u002Fdocker\u002Fdaemon.json 2>\u002Fdev\u002Fnull > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fdaemon_config.json\n\n# Examine Docker events log\ncat $DOCKER_ROOT\u002Fcontainers\u002F$CONTAINER_ID\u002F*.log > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_json_logs.txt\n\n# Check for volume mounts (potential host filesystem access)\npython3 \u003C\u003C 'PYEOF'\nimport json\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_inspect.json') as f:\n    data = json.load(f)\n\ninspect = data[0] if isinstance(data, list) else data\n\nprint(\"=== CONTAINER SECURITY ANALYSIS ===\\n\")\n\n# Check mounts\nprint(\"Volume Mounts:\")\nfor mount in inspect.get('Mounts', []):\n    rw = \"READ-WRITE\" if mount.get('RW') else \"READ-ONLY\"\n    print(f\"  {mount.get('Source', 'N\u002FA')} -> {mount.get('Destination', 'N\u002FA')} ({rw})\")\n    if mount.get('Source') in ('\u002F', '\u002Fetc', '\u002Fvar', '\u002Froot') and mount.get('RW'):\n        print(f\"    WARNING: Sensitive host path mounted read-write!\")\n\n# Check privileged mode\nhost_config = inspect.get('HostConfig', {})\nif host_config.get('Privileged'):\n    print(\"\\nWARNING: Container was running in PRIVILEGED mode!\")\n\n# Check capabilities\ncap_add = host_config.get('CapAdd', [])\nif cap_add:\n    print(f\"\\nAdded Capabilities: {cap_add}\")\n    dangerous_caps = ['SYS_ADMIN', 'SYS_PTRACE', 'NET_ADMIN', 'SYS_MODULE']\n    for cap in cap_add:\n        if cap in dangerous_caps:\n            print(f\"  WARNING: Dangerous capability: {cap}\")\n\n# Check PID namespace\nif host_config.get('PidMode') == 'host':\n    print(\"\\nWARNING: Container shares host PID namespace!\")\n\n# Check network mode\nif host_config.get('NetworkMode') == 'host':\n    print(\"\\nWARNING: Container shares host network namespace!\")\n\n# Check user\nuser = inspect.get('Config', {}).get('User', 'root (default)')\nprint(f\"\\nRunning as user: {user}\")\n\n# Check environment variables for secrets\nenv_vars = inspect.get('Config', {}).get('Env', [])\nprint(f\"\\nEnvironment Variables: {len(env_vars)}\")\nfor env in env_vars:\n    key = env.split('=')[0]\n    if any(s in key.upper() for s in ['PASSWORD', 'SECRET', 'KEY', 'TOKEN', 'CREDENTIAL']):\n        print(f\"  SENSITIVE: {key}=***REDACTED***\")\nPYEOF\n```\n\n### Step 4: Analyze Container File System Changes\n\n```bash\n# Compare container filesystem to original image\ndocker diff $CONTAINER_ID > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Ffilesystem_changes.txt\n\n# A = Added, C = Changed, D = Deleted\n# Analyze changes\npython3 \u003C\u003C 'PYEOF'\nadded = []\nchanged = []\ndeleted = []\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Ffilesystem_changes.txt') as f:\n    for line in f:\n        line = line.strip()\n        if line.startswith('A '):\n            added.append(line[2:])\n        elif line.startswith('C '):\n            changed.append(line[2:])\n        elif line.startswith('D '):\n            deleted.append(line[2:])\n\nprint(f\"Files Added: {len(added)}\")\nprint(f\"Files Changed: {len(changed)}\")\nprint(f\"Files Deleted: {len(deleted)}\")\n\n# Flag suspicious additions\nsuspicious = [f for f in added if any(s in f for s in\n    ['\u002Ftmp\u002F', '\u002Fdev\u002Fshm\u002F', '\u002Froot\u002F', '.sh', '.py', '.elf', 'reverse', 'shell', 'backdoor'])]\nif suspicious:\n    print(f\"\\nSuspicious Added Files:\")\n    for f in suspicious:\n        print(f\"  {f}\")\n\n# Flag suspicious changes\nsus_changed = [f for f in changed if any(s in f for s in\n    ['\u002Fetc\u002Fpasswd', '\u002Fetc\u002Fshadow', '\u002Fetc\u002Fcrontab', '\u002Fetc\u002Fssh', '.bashrc'])]\nif sus_changed:\n    print(f\"\\nSuspicious Changed Files:\")\n    for f in sus_changed:\n        print(f\"  {f}\")\nPYEOF\n\n# Extract and examine the container export\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_fs\u002F\ntar -xf \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_export.tar -C \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_fs\u002F\n\n# Scan for webshells and malicious files\nfind \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_fs\u002Ftmp\u002F -type f -exec file {} \\;\nfind \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_fs\u002F -name \"*.php\" -newer \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_fs\u002Fetc\u002Fhostname\n```\n\n### Step 5: Scan for Vulnerabilities and Generate Report\n\n```bash\n# Scan the image for known vulnerabilities\ntrivy image forensic-evidence:case-2024-001 \\\n   --format json \\\n   --output \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fvulnerability_scan.json\n\n# Scan the exported filesystem\ntrivy fs \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_fs\u002F \\\n   --format table \\\n   --output \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Ffs_vulnerabilities.txt\n\n# Check for secrets in the image\ntrivy image forensic-evidence:case-2024-001 \\\n   --scanners secret \\\n   --format json \\\n   --output \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fsecrets_scan.json\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Image layers | Read-only filesystem layers stacked to form the container image |\n| overlay2 | Default Docker storage driver using union filesystem for layers |\n| Container diff | Comparison of runtime filesystem changes against the original image |\n| Privileged mode | Container with full host capabilities (bypasses most isolation) |\n| Docker socket | Unix socket (\u002Fvar\u002Frun\u002Fdocker.sock) controlling the Docker daemon |\n| Container escape | Technique for breaking out of container isolation to the host |\n| Volume mounts | Host filesystem paths made accessible inside the container |\n| Image history | Record of Dockerfile instructions used to build each layer |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| docker inspect | Detailed container configuration and state information |\n| docker diff | Show filesystem changes made in a running\u002Fstopped container |\n| dive | Interactive Docker image layer analysis tool |\n| container-diff | Google tool for comparing container image contents |\n| Trivy | Vulnerability scanner for container images and filesystems |\n| docker-explorer | Forensic tool for offline Docker artifact analysis |\n| Sysdig | Container runtime security monitoring and forensics |\n| Falco | Runtime threat detection for containers and Kubernetes |\n\n## Common Scenarios\n\n**Scenario 1: Web Application Container Compromise**\nExport the container filesystem, identify webshells in web root, analyze access logs for exploitation attempts, check for added files and modified configurations, examine network connections for C2 communication, review container capabilities for escalation paths.\n\n**Scenario 2: Supply Chain Attack via Malicious Image**\nAnalyze image layers with dive to identify which layer added malicious content, compare with the official base image using container-diff, check image history for suspicious RUN commands, scan for embedded backdoors and cryptocurrency miners, trace the image pull from registry logs.\n\n**Scenario 3: Container Escape Investigation**\nCheck if container ran privileged or with dangerous capabilities, examine host filesystem mount points for unauthorized access, review Docker socket mount enabling Docker-in-Docker abuse, analyze host system logs for container escape indicators, check for kernel exploit artifacts.\n\n**Scenario 4: Cryptojacking in Container Environment**\nIdentify high-CPU containers, export and analyze the container image for mining binaries, check for unauthorized images in the registry, review container creation events for rogue deployments, examine network connections for mining pool communications.\n\n## Output Format\n\n```\nDocker Container Forensics Summary:\n  Container: abc123def456 (nginx-app)\n  Image: company\u002Fweb-app:v2.1\n  Status: Running (started 2024-01-10 09:00 UTC)\n  Host: docker-host-01.corp.local\n\n  Security Configuration:\n    Privileged: No\n    Capabilities Added: NET_ADMIN (WARNING)\n    Volume Mounts: \u002Fvar\u002Flog -> \u002Fhost-logs (RW)\n    Network Mode: bridge\n    User: root (WARNING)\n\n  Filesystem Changes:\n    Added: 23 files (5 suspicious)\n    Changed: 12 files (2 suspicious)\n    Deleted: 0 files\n\n  Suspicious Findings:\n    \u002Ftmp\u002Freverse.sh - Reverse shell script (Added)\n    \u002Fvar\u002Fwww\u002Fhtml\u002F.hidden\u002Fshell.php - PHP webshell (Added)\n    \u002Fetc\u002Fcrontab - Modified (persistence cron entry added)\n    \u002Froot\u002F.ssh\u002Fauthorized_keys - Modified (unauthorized key added)\n\n  Vulnerability Scan:\n    Critical: 3 (CVE-2024-xxxx in base image)\n    High: 12\n    Medium: 34\n\n  Evidence: \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002F\n```\n",{"name":5,"tags":52,"capec":53,"model":54,"tools":55,"domain":45,"maxTurns":59,"nist_csf":60,"subdomain":31,"description":7,"mitre_attack":65},[29,27,39,37,36,35],[],"sonnet",[56,43,57,58],"Read","Glob","Grep",20,[61,62,63,64],"RS.AN-01","RS.AN-03","DE.AE-02","RS.MA-01",[66],"T1610","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fcloud\u002Fforensics\u002Fdocker\u002Fdetect","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":75,"prompt":85,"zipAvailable":86},[76,79,82],{"tool":77,"command":78},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill forensics-docker-detect",{"tool":80,"command":81},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill forensics-docker-detect",{"tool":83,"command":84},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill forensics-docker-detect","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fforensics\u002Fdocker\u002Fdetect\u002FSKILL.md",true,[88],{"path":89,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"index.json","REFERENCE","参考文档",632,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fforensics\u002Fdocker\u002Fdetect\u002Findex.json",[95,117,137,156,178,194],{"skillNo":96,"name":97,"nameZh":6,"description":98,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":99,"categories":100,"keywords":101,"publishedAt":47},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[102,28,103,104,105,38,106,107,108,109,110,111,112,113,114,115,29,45,116],"services","services wmi persistence detect","wmi","persistence","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","process-forensics",{"skillNo":118,"name":119,"nameZh":6,"description":120,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":121,"categories":122,"keywords":123,"publishedAt":47},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[124,102,125,104,126,127,128,45,43,42,129,130,131,132,38,133,134,34,135,136],"exploit","services wmi exec exploit","exec","remote","traffic","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":138,"name":139,"nameZh":6,"description":140,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":141,"categories":142,"keywords":143,"publishedAt":47},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[144,145,146,147,148,149,45,43,150,42,151,152,38,34,153,32,31,154,155,54],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","windows-registry","regripper",{"skillNo":157,"name":158,"nameZh":6,"description":159,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":162,"publishedAt":47},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[28,163,164,165,166,167,168,106,169,45,116,170,171,172,173,174,175,176,177,38],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":179,"name":180,"nameZh":6,"description":181,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":182,"categories":183,"keywords":184,"publishedAt":47},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[185,186,28,187,165,167,188,106,189,169,45,116,42,190,191,192,193,177,38,107],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":195,"name":196,"nameZh":6,"description":197,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":198,"categories":199,"keywords":200,"publishedAt":47},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[201,28,165,202,188,106,203,204,45,116,205,206,44,207,208,209,38,107,210,211],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","pe-header","in memory","with","mismatched","headers"]