Comparison of Vulnerability Scanners for Detecting Obfuscated Malware in Containers

The growing popularity of containerization in cloud environments is accompanied by an increasing number of attacks that leverage obfuscated malware designed to evade detection by static scanners. This paper presents an experimental comparison of two container security tools – Trivy (static analysis) and Tracee (dynamic observation based on eBPF) – in detecting malicious executables hidden in non-standard paths such as /tmp/.

A scenario was created to simulate the execution of an obfuscated binary file inside a container, mimicking typical attacker behavior. Trivy failed to detect any threat within the image, whereas Tracee successfully captured the actual execution of the malicious code at runtime. To visualize the results, a GitHub Actions workflow was implemented to automatically generate reports and metrics, including the Suspicious Exec Rate – the ratio of executions from non-standard paths to the total number of execve events.

The results highlight the limitations of signature-based SCA analysis and emphasize the importance of complementing static scanning with dynamic behavior analysis methods. The proposed approach enables the effective detection of threats that remain unnoticed in traditional CI/CD pipelines.