Tracee Runtime Security Series: Easy Installation on Kubernetes

This blog shows how to deploy and validate Tracee (an open-source runtime security tool) in a Kubernetes cluster and demonstrates detection of a simulated real-world attack: a command-injection exploit against an OWASP Mutillidae app that yields a reverse shell, subsequent use of kubectl and a service-account token for privilege escalation, and theft of the cluster CA private key — with Tracee signatures and logs capturing each malicious action.