AWS EKS Pod Exec Sensitive File or Credential Path Access

  1[metadata]
  2creation_date = "2026/08/03"
  3integration = ["aws"]
  4maturity = "production"
  5min_stack_comments = "The AWS integration adds the aws.eks_audit data stream in package 8.9.0, which requires Kibana 9.6.0 or later."
  6min_stack_version = "9.6.0"
  7updated_date = "2026/10/20"
  8
  9[rule]
 10author = ["Elastic"]
 11description = """
 12Detects Kubernetes pod exec sessions whose decoded command line references high-value host or in-cluster paths and
 13material types: mounted service account or platform tokens, kubelet and control-plane configuration areas, host identity
 14stores, root dot-directories for cloud and kubeconfig material, common private-key and keystore extensions, process
 15environment dumps, and configuration filenames suggestive of embedded secrets. The intent is to catch interactive or
 16scripted access that often precedes lateral movement, privilege escalation, or credential theft from the node or
 17workload boundary. A narrow exclusion ignores benign reads of resolv.conf. The query also labels an access_type bucket
 18to speed triage without altering the detection predicates you validated.
 19"""
 20from = "now-6m"
 21language = "esql"
 22license = "Elastic License v2"
 23name = "AWS EKS Pod Exec Sensitive File or Credential Path Access"
 24note = """## Triage and analysis
 25
 26### Investigating AWS EKS Pod Exec Sensitive File or Credential Path Access
 27This alert ties Kubernetes audit exec events to reconstructed command text that matches sensitive path and filename
 28patterns. Use the Esql.access_type field to prioritize: IRSA token paths, default Kubernetes service account tokens,
 29other mounted secrets, certificates and keystores, Kubernetes static config, kubelet state, host passwd or shadow,
 30user home credential stores, and proc environ scraping.
 31
 32### Possible investigation steps
 33
 34- Identify the Kubernetes user, groups, impersonation, source IP, and user agent for the exec caller.
 35- Map objectRef namespace, pod, and container to an owning team, image digest, and change history.
 36- Compare Esql.executed_command against known runbooks; capture follow-on audit activity such as additional execs,
 37  secret reads at the API layer, or RBAC changes.
 38- If host-level paths appear, determine whether the workload runs privileged, with hostPath mounts, or on nodes where
 39  break-glass access is expected.
 40
 41### False positive analysis
 42
 43- Diagnostic images and vendor agents sometimes cat resolv.conf or kubeconfig-like paths; the rule excludes resolv.conf
 44  but other matches may still be legitimate—baseline stable automation identities.
 45- Training containers that deliberately demonstrate passwd reads can trigger; scope exceptions to those images and
 46  namespaces.
 47
 48### Response and remediation
 49
 50- If malicious, end the exec session, isolate the pod or node, rotate any credentials that could have been read,
 51  review and tighten pods exec RBAC and admission controls, and inspect for persistence added after the session."""
 52references = ["https://www.sysdig.com/blog/scarleteel-2-0"]
 53risk_score = 73
 54rule_id = "c85aede4-2273-575a-86f8-f1552140a6b3"
 55setup = """This rule reads EKS control-plane audit logs collected by the AWS integration
 56into `logs-aws.eks_audit-*`, where the AWS EKS audit ingest
 57pipelines normalize each audit record under `aws.eks.audit.*`.
 58
 59Enable the `audit` control-plane log type on the EKS cluster, send its
 60CloudWatch log group through the AWS integration, and confirm events carry
 61`data_stream.dataset: aws.eks_audit` and
 62`cloud.provider: aws` before enabling this rule.
 63"""
 64severity = "high"
 65tags = [
 66    "Domain: Cloud",
 67    "Domain: Containers",
 68    "Platform: AWS",
 69    "Platform: Kubernetes",
 70    "Data Source: AWS",
 71    "Data Source: Amazon Web Services",
 72    "Data Source: Kubernetes API Server Audit Logs",
 73    "Service: AWS EKS",
 74    "Use Case: Threat Detection",
 75    "Tactic: Credential Access",
 76    "Tactic: Execution",
 77    "Rule Type: ES|QL",
 78    "Resources: Investigation Guide",
 79    "Profile: Beta",
 80]
 81timestamp_override = "event.ingested"
 82type = "esql"
 83
 84query = '''
 85from logs-aws.eks_audit-* metadata _id, _index, _version
 86| WHERE aws.eks.audit.objectRef.subresource == "exec"
 87  AND aws.eks.audit.requestURI LIKE "*command=*"
 88| EVAL decoded_uri = URL_DECODE(aws.eks.audit.requestURI)
 89| GROK decoded_uri "%{DATA}/exec\\?%{DATA:raw_commands}&(?:container|stdin|stdout|stderr)=%{GREEDYDATA}"
 90| EVAL command = REPLACE(raw_commands, "command=", "")
 91| EVAL command = REPLACE(command, "&", " ")
 92| EVAL Esql.executed_command = REPLACE(command, "\\+", " ")
 93| WHERE Esql.executed_command IS NOT NULL
 94  AND Esql.executed_command RLIKE """.*(/var/run/secrets/|/etc/kubernetes/|/var/lib/kubelet/|/etc/shadow|/etc/passwd|/etc/sudoers|(/root|/home/[^/]+)/\.(ssh|aws|azure|kube|config/gcloud)|\.p12|\.pem|\.key|\.jks|\.keystore|/etc/.*\.conf.*(password|secret|key|token|credential)|/proc/.*/environ).*"""
 95  AND NOT Esql.executed_command RLIKE """.*/etc/resolv\.conf.*"""
 96| EVAL Esql.access_type = CASE(
 97    Esql.executed_command RLIKE """.*/var/run/secrets/eks\.amazonaws\.com.*""", "AWS_IRSA_TOKEN",
 98    Esql.executed_command RLIKE """.*/var/run/secrets/pods\.eks\.amazonaws\.com.*""", "AWS_POD_IDENTITY_TOKEN",
 99    Esql.executed_command RLIKE """.*/var/run/secrets/azure/tokens/.*""", "AZURE_WORKLOAD_IDENTITY_TOKEN",
100    Esql.executed_command RLIKE """.*/var/run/secrets/tokens/gcp-ksa/.*""", "GCP_WORKLOAD_IDENTITY_TOKEN",
101    Esql.executed_command RLIKE """.*/var/run/secrets/kubernetes\.io/serviceaccount/token.*""", "K8S_SA_TOKEN",
102    Esql.executed_command RLIKE """.*/var/run/secrets/.*""", "MOUNTED_SECRET",
103    Esql.executed_command RLIKE """.*\.(p12|pem|key|jks|keystore).*""", "CERTIFICATE_OR_KEY",
104    Esql.executed_command RLIKE """.*/etc/kubernetes/.*""", "K8S_CONFIG",
105    Esql.executed_command RLIKE """.*/var/lib/kubelet/.*""", "KUBELET_CONFIG",
106    Esql.executed_command RLIKE """.*/etc/shadow.*""", "HOST_CREDENTIALS",
107    Esql.executed_command RLIKE """.*/etc/passwd.*""", "USER_ENUMERATION",
108    Esql.executed_command RLIKE """.*/etc/sudoers.*""", "SUDOERS_ACCESS",
109    Esql.executed_command RLIKE """.*(/root|/home/[^/]+)/\.(ssh|aws|azure|kube|config/gcloud).*""", "USER_CREDENTIALS",
110    Esql.executed_command RLIKE """.*/proc/.*/environ.*""", "PROCESS_ENV_SECRETS",
111    Esql.executed_command RLIKE """.*/etc/.*\.conf.*(password|secret|key|token|credential).*""", "EMBEDDED_CONFIG_SECRET",
112    "OTHER_SENSITIVE"
113  )
114| KEEP Esql.*, @timestamp, user.name, source.ip, user_agent.original, event.action, aws.eks.audit.objectRef.namespace, aws.eks.audit.objectRef.name, aws.eks.audit.requestURI, aws.eks.audit.user.username, data_stream.namespace, _id, _index, _version
115'''
116
117
118[[rule.threat]]
119framework = "MITRE ATT&CK"
120[[rule.threat.technique]]
121id = "T1552"
122name = "Unsecured Credentials"
123reference = "https://attack.mitre.org/techniques/T1552/"
124[[rule.threat.technique.subtechnique]]
125id = "T1552.001"
126name = "Credentials In Files"
127reference = "https://attack.mitre.org/techniques/T1552/001/"
128
129[[rule.threat.technique.subtechnique]]
130id = "T1552.007"
131name = "Container API"
132reference = "https://attack.mitre.org/techniques/T1552/007/"
133
134
135
136[rule.threat.tactic]
137id = "TA0006"
138name = "Credential Access"
139reference = "https://attack.mitre.org/tactics/TA0006/"
140[[rule.threat]]
141framework = "MITRE ATT&CK"
142[[rule.threat.technique]]
143id = "T1609"
144name = "Container Administration Command"
145reference = "https://attack.mitre.org/techniques/T1609/"
146
147
148[rule.threat.tactic]
149id = "TA0002"
150name = "Execution"
151reference = "https://attack.mitre.org/tactics/TA0002/"