Detecting crypto-mining attacks
In this section, we are going to talk about detecting crypto-mining activities in the Kubernetes cluster with some of the open source tools we introduced in earlier chapters. We detect crypto-mining activities based on the known patterns of crypto-mining: high CPU usage, communicating to mining pools, the executed command line of miner, and the binary signature. Note that each individual measure has its own limitations. Combining them improves the efficiency of detection for sure. However, there are still some advanced crypto-mining attacks, such as the one that attacked Tesla. It's necessary for you to work with your security team to apply a comprehensive detection strategy for your Kubernetes cluster to cover all kinds of intrusion.
In order to demonstrate each tool to detect crypto-mining, we simulate a victim nginx pod:
$ kubectl get pods -n insecure-nginx NAMEÂ Â Â Â Â Â Â Â Â Â Â Â &...
