Microsoft Defender for Containers and AKS

Microsoft Defender for Containers is a cloud-native security solution within Microsoft Defender for Cloud that protects your Kubernetes clusters, including AKS, Amazon EKS, Google GKE, and on-premises clusters. It provides three core capabilities: - Vulnerability assessment: Scans container images in Azure Container Registry (ACR) and other registries for known vulnerabilities (CVEs). - Runtime threat detection: Monitors cluster activities, including node-level and Kubernetes audit logs, to detect suspicious behavior. - Compliance and hardening: Assesses clusters against industry standards like CIS benchmarks for Kubernetes and Azure Security Benchmark.

Why does this exist? Containers introduce unique security challenges: they share the host kernel, images may contain outdated libraries, and Kubernetes itself has a large attack surface (e.g., misconfigured RBAC, exposed dashboards). Defender for Containers addresses these by providing a single pane of glass for container security, integrating with your CI/CD pipeline, and automating detection of threats like cryptojacking, container escapes, and privilege escalations.

Defender for Containers operates at multiple layers:

1. Image Scanning When you push an image to ACR, Defender automatically triggers a scan. It extracts the image layers and compares the installed packages against a database of known vulnerabilities (CVE database updated daily). The scan is agentless — it happens in the registry, not on the cluster. Scans are free for the first 30 days after enabling Defender for Containers; after that, images are scanned on pull and weekly. The scanning engine uses the same technology as Microsoft Defender for Cloud's vulnerability assessment for VMs.

2. Cluster-Level Threat Detection Defender for Containers uses two data sources: - Kubernetes audit logs: It enables the Kubernetes audit log feature (if not already enabled) and streams these logs to Defender for Cloud. It analyzes API requests for suspicious patterns, such as attempts to create pods with privileged containers, use of host network, or mounting of sensitive host paths. - Node-level monitoring via an Azure Arc-enabled Kubernetes extension: On each AKS node, Defender deploys a DaemonSet (called microsoft.azuredefender.kubernetes) that uses eBPF (Extended Berkeley Packet Filter) to monitor system calls and network traffic at the kernel level. This allows detection of container escapes (e.g., a process breaking out of its container namespace), crypto mining processes, and unusual network connections.

3. Compliance and Hardening Defender for Containers continuously assesses your cluster against the CIS Kubernetes Benchmark (v1.6.1 for AKS). It checks 100+ rules, such as: - --anonymous-auth should be set to false - --authorization-mode should include RBAC - Pod Security Policies (or OPA/Gatekeeper) should be enforced - etcd should have TLS encryption

Results appear as recommendations in Defender for Cloud with a severity level and a remediation step.

To enable Defender for Containers on an AKS cluster via Azure CLI:

# Enable Defender for Cloud on the subscription (if not already)
az security pricing create -n Containers --tier Standard

# Or enable at the cluster level (recommended)
az aks update --name myAKSCluster --resource-group myResourceGroup --enable-defender

To verify that Defender is enabled:

az aks show --name myAKSCluster --resource-group myResourceGroup --query securityProfile

Output should show "defender": {"enabled": true}.

To check the status of the Defender DaemonSet:

kubectl get pods -n kube-system -l app=defender

To view alerts for a cluster in Defender for Cloud:

az security alert list --query "[?contains(properties.compromisedEntity, 'myAKSCluster')]"

Defender for Containers generates alerts for scenarios like: - Crypto mining: Detection of CPU spikes and network connections to known mining pools. - Privileged container creation: API calls to create a pod with privileged: true. - Container escape: System calls indicating a process has broken out of its container (e.g., using nsenter or unshare). - Suspicious network activity: Connections to known malicious IPs or unusual ports. - Kubernetes dashboard exposure: An API request that exposes the dashboard via a LoadBalancer service.

Each alert includes a description, severity, affected entities (pod, node, cluster), and recommended remediation steps.

A large e-commerce company runs hundreds of microservices on AKS, with images built and pushed to ACR multiple times a day. They need to ensure no vulnerable libraries reach production. Defender for Containers is configured to scan all images on push and block deployment if critical vulnerabilities exist (via Azure Policy integration). In production, they use the runtime monitoring to detect cryptojacking — a common threat where attackers deploy containers that mine cryptocurrency. One incident involved a container that was using excessive CPU and making connections to a known mining pool. Defender alerted within seconds, and the team used the alert to kill the pod and investigate the compromised image. The key lesson: Defender's eBPF-based detection caught the mining process even though the container was not privileged.

A bank runs AKS clusters that must comply with PCI DSS. Defender for Containers provides continuous compliance assessment against the CIS Kubernetes Benchmark. The security team uses the recommendations to enforce RBAC, disable anonymous authentication, and ensure that etcd is encrypted. They also use Defender's integration with Azure Policy to automatically deny the creation of pods that mount sensitive host paths. A common misconfiguration: developers creating pods with hostPID: true to debug, which can lead to container escape. Defender flags this as a high-severity alert. The bank also exports all alerts to Azure Sentinel for correlation with other security events.