To confirm whether malware exists within a container image, CrowdStrike Falcon Cloud Security directs investigators to reviewImage detection findings. These findings are generated during container image assessments, where Falcon performs deep inspection of image layers, binaries, and embedded artifacts.

Image detection findings include indicators of known malware, suspicious executables, malicious scripts, and other threats identified through CrowdStrike’s threat intelligence and detection engines. Because container images are often reused across environments, identifying malware at the image level is critical to preventing widespread propagation.

Other options do not directly confirm malware within an image.Drift indicatorsrelate to changes in a running container compared to its original image, not malware embedded in the image itself.Container alertsare typically runtime detections triggered by behavior during execution.Container misconfigurationsfocus on insecure settings rather than malicious code.

By reviewing image detection findings, security teams can identify infected images early, remediate by rebuilding clean images, and prevent deployment through policy enforcement mechanisms such as the Kubernetes Admission Controller. Therefore, the correct investigation path for suspected malware in a container image isImage detection findings.