Skip to content
CKSMonitoring, Logging and Runtime SecuritySingle nodeMedium

Find and contain a crypto-miner process

Scenario cks-run-003 · about 7 minutes · 8 points · 3 grader checks

Investigate running containers to find the one executing a mining process, record it and contain it without destroying evidence.

  • runtime-security
  • incident-response
  • processes
  • behavioral-analytics
  • crictl

What you will practise

  • Inspect processes inside containers and on the node
  • Map a suspicious process back to its Pod and Deployment
  • Contain a workload while keeping it for forensics

Start this lab

With the CLI installed and signed in, this command provisions a single node cluster on your Mac, applies the scenario setup and prints the task below.

goldenkube start cks-run-003

Task

The task text exactly as the CLI shows it. Solve it on the cluster, then run goldenkube submit.

An intrusion detection alert says that a container in namespace "runtime" runs a cryptocurrency miner: a process whose command line contains "stratum+tcp://". The namespace runs three Deployments: "checkout", "catalog" and "search". 1. Find the Deployment whose container runs that process and write its name (only the name) to /opt/runtime/compromised.txt on exam-cp1. 2. Stop the miner by scaling that Deployment to 0 replicas. Keep the Deployment for forensics (do not delete it) and leave the other two Deployments running.

Requirements and details

Certification
CKS · Certified Kubernetes Security Specialist
Domain
Monitoring, Logging and Runtime Security
Difficulty
Medium
Cluster topology
Single node
Cluster features
None beyond the base cluster
Recommended time
7 minutes
Points
8
Grader checks
3
Kubernetes version
1.35
Minimum CLI version
0.1.0
Scenario version
1
Published

Grading runs locally: 3 state checks read your cluster when you submit; the scenario passes when every check passes. Hints, the reference solution and the check definitions are available only inside the CLI, not on this page.

Install the CLICreate a free account

More Monitoring, Logging and Runtime Security labs

CKSMonitoring, Logging and Runtime SecurityHard

Audit logging with a tailored policy

Write an audit policy with per-resource levels and wire it into the API server static pod with log rotation.

Single node · ~10 min · 9 points

  • audit-logging
  • kube-apiserver
  • audit-policy
  • static-pod
  • monitoring

goldenkube start cks-run-001

CKSMonitoring, Logging and Runtime SecurityMedium

Immutable containers at runtime

Run nginx with a read-only root filesystem, keeping only the directories it really needs writable through emptyDir volumes.

Single node · ~8 min · 7 points

  • immutability
  • readonlyrootfilesystem
  • emptydir
  • runtime-security
  • deployment

goldenkube start cks-run-002

CKSMonitoring, Logging and Runtime SecurityMedium

Investigate an audit log and revoke access

Use an exported audit log to identify who deleted a Secret and from where, then revoke that user's namespace access.

Single node · ~8 min · 8 points

  • audit-logs
  • incident-response
  • jq
  • rbac
  • investigation

goldenkube start cks-run-004

Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation. Lab results are practice feedback, not an exam score.