Container image scanning can't catch a runtime hijack. Microsoft Defender for Cloud detects binary drift: a container executing something it was never built to run.Containers should be immutable, running only what shipped in the original image. When hijacked containers started running crypto-mining processes, Defender flagged the initial binary drift, surfacing a suspicious parent process and the shim file used to execute it, with full evidence across process, file, pod, and cluster.This activit