K8s API-based mock cgroup creation for SPIRE spoofing

Arnold Chan@slaz

•updated Sep 10, 2026•0•0•1

Detects unauthorized attempts to manipulate cgroup files (e.g., cgroup.procs) within Kubernetes pods using kubectl exec/attach sessions. This technique is often associated with SPIRE attestation spoofing or container escape attempts where an attacker attempts to influence process management or isolation constraints from within the container via the Kubernetes API.