Implement runtime container threat protection
Implementation Effort: Medium – Enabling Defender for Containers and deploying its sensors across AKS and any EKS, GKE, or Arc-connected clusters is a multi-step rollout with cloud and platform teams.
User Impact: Low – Runtime protection monitors clusters behind the scenes; users of the workloads are not affected.
Lifecycle Stage: Run
Overview
Implement Microsoft Defender for Containers runtime threat protection on Kubernetes clusters so post-deployment malicious process, network, and control-plane activity is detected. Prereqs: enable Microsoft Defender for Containers in Microsoft Defender for Cloud and complete the documented deployment steps for each environment. For AKS, use the Azure-native Defender for Containers onboarding path so Azure-managed integrations deploy the required components. For EKS, GKE, and on-premises clusters, use the supported multicloud connector or Azure Arc path and deploy the required Defender components. Confirm the current support matrix, required roles, and alert integration prerequisites for each platform.
Container workloads running in Kubernetes clusters are dynamic, distributed, and often internet-facing. Static controls such as image scanning and admission policies remain important, but they only address the state of a container at or before deployment. Once a container is running, threat actors can exploit runtime vulnerabilities to execute malicious processes, escalate privileges, establish reverse shells, deploy cryptominers, or move laterally across the cluster.
This control focuses on runtime behavioral detections after deployment. Image vulnerability assessment and gated deployment are related but separate controls with different prerequisites. Defender for Containers uses in-cluster components such as the Defender sensor and Kubernetes API access, where supported, to monitor process creation, network activity, and Kubernetes API server behavior in real time.
Defender for Containers maps detections to the MITRE ATT&CK framework, covering tactics from initial access through lateral movement and exfiltration. It detects behaviors such as web shell creation, execution of binaries not present in the original container image, privileged container deployment, anomalous service account activity, and network reconnaissance from within a pod. This helps security teams detect and contain post-deployment attacks before they spread across the cluster.
Without runtime container threat protection, Kubernetes clusters are effectively unmonitored once workloads are deployed. Threat actors who achieve initial access through an application vulnerability or a compromised dependency can operate undetected for extended periods, exfiltrating data or pivoting to other workloads and cloud resources. Microsoft Defender for Containers supports AKS and extends selected protections to supported multicloud and Arc-connected Kubernetes environments, but runtime capabilities, onboarding steps, and response experiences vary by platform. Validate the current support matrix before assuming parity across AKS, EKS, GKE, and Arc-connected clusters. Continuously monitoring running workloads for malicious behavior is a direct application of Assume breach, treating post-deployment compromise as expected and ensuring it is detected and contained rather than assumed away.