osquery-defense-kit/docker/unexpected-privileged-containers.sql

SELECT
  *
FROM
  docker_containers
WHERE
  privileged = 1
  AND image NOT LIKE "kindest/node:%";