[Intel]: https://sysdig.com/blog/containers-read-only-fileless-malware/

[timb-machine]

Area

Offensive techniques

Parent threat

Persistence, Defense Evasion

Finding

https://sysdig.com/blog/containers-read-only-fileless-malware/

Industry reference

attack:T1202:Indirect Command Execution
attack:T1620:Reflective Code Loading
uses:Non-persistentStorage
uses:k8s

Malware reference

No response

Actor reference

No response

Component

Linux

Scenario

Cloud hosted services

Scenario variation

Device application sandboxing