Microsoft Defender detects multiple security alerts for Selenium hub on AKS

[otoxolae]

My security team was wondering if this is intended behaviour, including this line
/bin/sh -c /sbin/modprobe msr allow_writes=on > /dev/null 2>&1

[VietND96]

Can you explain a little bit on this, it means execute that command in part of container entry point?

[otoxolae]

I believe Windows Defender scans the image and found that line suspicious, here is a better image of the warning:

[otoxolae]

Do you know the purpose of this line? To them it looks like crypto-mining I guess

[diemol]

Is your Grid exposed?
You might be a victim of https://www.selenium.dev/blog/2024/protecting-unsecured-selenium-grid/

[otoxolae]

I don't think so, since this warning appeared immediately after creating the cluster. But I'll check it out, Thanks