AWS EKS Pod Exec Potential Reverse Shell

  1[metadata]
  2creation_date = "2026/08/03"
  3integration = ["aws"]
  4maturity = "production"
  5min_stack_comments = "The AWS integration adds the aws.eks_audit data stream in package 8.9.0, which requires Kibana 9.6.0 or later."
  6min_stack_version = "9.6.0"
  7updated_date = "2026/10/20"
  8
  9[rule]
 10author = ["Elastic"]
 11description = """
 12Flags exec into a pod when the URL-decoded command payload resembles reverse-shell or bind-shell one-liners invocation
 13patterns. Legitimate debug sessions sometimes use similar building blocks, but together these patterns align with
 14post-exploitation interactive access and command-and-control.
 15"""
 16from = "now-6m"
 17language = "esql"
 18license = "Elastic License v2"
 19name = "AWS EKS Pod Exec Potential Reverse Shell"
 20note = """## Triage and analysis
 21
 22### Investigating AWS EKS Pod Exec Potential Reverse Shell
 23The rule inspects Kubernetes audit exec requestURI values, URL-decodes them, parses the command query fragment, and
 24matches high-signal shell and socket idioms often used to obtain a allback shell from inside a container.
 25
 26### Possible investigation steps
 27
 28- Identify the actor (aws.eks.audit.user.username, groups, impersonation), source IP, and user agent
 29  (human kubectl vs automation).
 30- Resolve the target namespace, pod, and container from aws.eks.audit.objectRef.* and correlate with
 31  workload ownership and change tickets.
 32- Pull the raw and decoded URI from the alert document and replay the inferred command in a sandbox only if policy
 33  allows—otherwise rely on audit and platform logs.
 34- Hunt nearby events from the same identity: secret reads, pods/exec to other workloads, RoleBinding
 35  changes, or anonymous API use.
 36
 37### False positive analysis
 38
 39- Security training, CTF-style images, or vendor diagnostics may include bash redirection or /dev/tcp examples;
 40  baseline approved images and break-glass accounts.
 41- Some observability or mesh sidecars use socat or sockets in ways that could overlap; validate container image and
 42  command lineage.
 43
 44### Response and remediation
 45
 46- If malicious, terminate the exec session, isolate the workload or node, rotate credentials reachable from the
 47  pod, and revoke pods/exec for the abused principal unless strictly required."""
 48references = ["https://attack.mitre.org/techniques/T1609/", "https://attack.mitre.org/techniques/T1059/"]
 49risk_score = 73
 50rule_id = "cbb10288-ee36-5879-b457-0f4f495c132e"
 51setup = """This rule reads EKS control-plane audit logs collected by the AWS integration
 52into `logs-aws.eks_audit-*`, where the AWS EKS audit ingest
 53pipelines normalize each audit record under `aws.eks.audit.*`.
 54
 55Enable the `audit` control-plane log type on the EKS cluster, send its
 56CloudWatch log group through the AWS integration, and confirm events carry
 57`data_stream.dataset: aws.eks_audit` and
 58`cloud.provider: aws` before enabling this rule.
 59"""
 60severity = "high"
 61tags = [
 62    "Domain: Cloud",
 63    "Domain: Containers",
 64    "Platform: AWS",
 65    "Platform: Kubernetes",
 66    "Data Source: AWS",
 67    "Data Source: Amazon Web Services",
 68    "Data Source: Kubernetes API Server Audit Logs",
 69    "Service: AWS EKS",
 70    "Use Case: Threat Detection",
 71    "Tactic: Execution",
 72    "Rule Type: ES|QL",
 73    "Threat: Reverse Shell",
 74    "Resources: Investigation Guide",
 75    "Profile: Beta",
 76]
 77timestamp_override = "event.ingested"
 78type = "esql"
 79
 80query = '''
 81FROM logs-aws.eks_audit-* metadata _id, _index, _version
 82| WHERE aws.eks.audit.objectRef.subresource == "exec"
 83  AND aws.eks.audit.requestURI LIKE "*command=*"
 84| EVAL decoded_uri = URL_DECODE(aws.eks.audit.requestURI)
 85| GROK decoded_uri "%{DATA}/exec\\?%{DATA:raw_commands}&(?:container|stdin|stdout|stderr)=%{GREEDYDATA}"
 86| EVAL command = REPLACE(raw_commands, "command=", "")
 87| EVAL command = REPLACE(command, "&", " ")
 88| EVAL Esql.executed_command = REPLACE(command, "\\+", " ")
 89| WHERE Esql.executed_command IS NOT NULL
 90| WHERE Esql.executed_command IS NOT NULL AND command RLIKE """.*(/dev/tcp/|/dev/udp/|zsh/net/tcp|zsh/net/udp|nc\s+-e|ncat\s+-e|netcat\s+-e|nc\s.*\s-c\s|mkfifo|socat\s.*exec|socat\s.*pty|bash\s+-i\s+>&|0>&1|>&\s*/dev/tcp|import\s+socket.*connect|import\s+pty.*spawn|socket\.socket.*connect|IO::Socket::INET|fsockopen|TCPSocket\.new|/inet/tcp/).*""" AND
 91 // local service health check patterns
 92  NOT command RLIKE """.*/dev/tcp/(localhost|127\.0\.0\.1)/(8080|8443|9090|3000|5000|8888|80|443).*"""
 93| KEEP Esql.*, @timestamp, user.name, source.ip, user_agent.original, event.action, aws.eks.audit.objectRef.namespace, aws.eks.audit.objectRef.name, aws.eks.audit.requestURI, aws.eks.audit.user.username, data_stream.namespace, _id, _index, _version
 94'''
 95
 96
 97[[rule.threat]]
 98framework = "MITRE ATT&CK"
 99[[rule.threat.technique]]
100id = "T1059"
101name = "Command and Scripting Interpreter"
102reference = "https://attack.mitre.org/techniques/T1059/"
103
104[[rule.threat.technique]]
105id = "T1609"
106name = "Container Administration Command"
107reference = "https://attack.mitre.org/techniques/T1609/"
108
109
110[rule.threat.tactic]
111id = "TA0002"
112name = "Execution"
113reference = "https://attack.mitre.org/tactics/TA0002/"