Runtime investigation: TC Sensitive File Read in Container

1. Confirm the runtime event

   Severity: **medium**. Verify the event genuinely matches the described behavior and not a known legitimate operation.

2. Locate the workload

   • Container / pod / image involved (container.id, k8s.pod.name, container.image)
   • Host node and triggering process (proc.name, proc.cmdline)
   • Is the container still running? capture its state before it disappears

3. Qualify the threat

   ATT&CK technique(s): T1552.001. Depending on the technique: container escape, privilege escalation, persistence or credential access? Look for the matching indicators in the event.

4. Scope

   • Same rule / same image triggered on other pods or nodes
   • Cross-check the orchestrator (deployment, namespace) to bound the blast radius

5. Response (informational, HITL)

   ⚠️ No automatic action. Network isolation of the pod, recreation from a clean image, rotation of exposed secrets — to be decided by a human.