Intro to forensics in the cloud: A container was compromised. What’s next?

This report is a cloud-forensics primer that walks through a simulated breach where weak WordPress credentials and an uploaded web shell led to a reverse shell, container escape via a privileged pod and docker.sock, creation of a privileged backdoor container for persistence, lateral movement to a data-fetcher pod, and exfiltration of sensitive S3 data. It emphasizes preparation and comprehensive logging (cloud provider audit logs, VPC flow logs, Kubernetes audit logs, workload snapshots, and runtime events) and illustrates investigation steps and prevention lessons.