<![CDATA[Containerized environments present significant security challenges due to their shared kernel architecture, which may be exploited as an entry point for infiltration attacks. One common vulnerability is Command Injection, enabling post-exploitation activities that are difficult to detect using conventional signature-based mechanisms. This study aims to implement and evaluate an active mitigation mechanism based on behavioral analysis by integrating the Linux Audit Daemon (Auditd) and CrowdSec within a Podman container environment. The research adopts an Experimental Security Testing approach by developing a Custom Process Bouncer that specifically monitors the execve system call to identify process relationships and automatically terminate malicious processes. Test results against four detection scenarios demonstrate that the proposed mechanism successfully reconstructed the attack process chain through PID cascade analysis and detected six malicious processes generated during the Command Injection scenario. All identified processes were automatically terminated with precision, causing the reverse shell session to be interrupted. These findings conclude that the integration of Auditd, CrowdSec, and the Custom Process Bouncer effectively neutralizes post-exploitation activities reliant on binary file execution, though further development is required to address fileless execution tactics.]]>
Copyrights © 2026
