AWS EKS Ephemeral Container Added to Pod

  1[metadata]
  2creation_date = "2026/08/03"
  3integration = ["aws"]
  4maturity = "production"
  5min_stack_comments = "The AWS integration adds the aws.eks_audit data stream in package 8.9.0, which requires Kibana 9.6.0 or later."
  6min_stack_version = "9.6.0"
  7updated_date = "2026/10/20"
  8
  9[rule]
 10author = ["Elastic"]
 11description = """
 12Detects allowed updates to the pods/ephemeralcontainers subresource by a non-system identity. Ephemeral containers are
 13commonly used for debugging (kubectl debug) but can also be abused to inject tooling into a running pod, access mounted
 14secrets, and execute commands in the target pod context. Attackers with sufficient RBAC may use ephemeral containers to
 15escalate privileges, move laterally, or establish persistence without deploying a new workload.
 16"""
 17false_positives = [
 18    """
 19    Cluster operators or SREs may legitimately use ephemeral containers for debugging production workloads. Baseline
 20    approved admin identities and tune exclusions for known automation.
 21    """,
 22]
 23from = "now-9m"
 24index = ["logs-aws.eks_audit-*"]
 25language = "kuery"
 26license = "Elastic License v2"
 27name = "AWS EKS Ephemeral Container Added to Pod"
 28note = """## Triage and analysis
 29
 30> **Disclaimer**:
 31> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 32
 33### Investigating AWS EKS Ephemeral Container Added to Pod
 34Ephemeral containers allow adding a container to an existing pod for troubleshooting. When abused, they can be used to
 35gain interactive access to a workload, read sensitive files, and run tools that were not present in the original image.
 36
 37### Possible investigation steps
 38
 39- Review the actor (user.name, groups), source.ip, and user_agent.original and confirm the identity is authorized to use ephemeral containers.
 40- Inspect aws.eks.audit.objectRef (namespace, name) to identify the targeted pod and workload owner.
 41- If request bodies are captured, review the ephemeral container image, command, and securityContext for privilege indicators.
 42- Correlate with follow-on audit activity such as pod exec, secret reads, TokenRequest, or RBAC modifications.
 43
 44### False positive analysis
 45
 46- Developers and SREs use `kubectl debug` to attach ephemeral containers to running pods for troubleshooting, especially on distroless images with no shell. Confirm the actor is authorized for the namespace and the activity matches an incident or support request.
 47- Debugging and observability tooling may inject ephemeral containers programmatically. If the actor is a known controller or automation identity, consider a scoped exception on user.name and namespace.
 48- Repeated use against production workloads, use by identities that do not normally debug pods, or debug images containing offensive tooling should still be reviewed even when the actor is otherwise legitimate.
 49
 50### Response and remediation
 51
 52- If unauthorized, remove excessive RBAC that grants update/patch on pods/ephemeralcontainers and rotate exposed credentials.
 53- Quarantine or redeploy impacted workloads and hunt for additional compromised pods or identities."""
 54references = ["https://kubernetes.io/docs/concepts/workloads/pods/ephemeral-containers/"]
 55risk_score = 47
 56rule_id = "62a8cc5d-f743-5c5b-8a65-9ad074523ea6"
 57setup = """This rule reads EKS control-plane audit logs collected by the AWS integration
 58into `logs-aws.eks_audit-*`, where the AWS EKS audit ingest
 59pipelines normalize each audit record under `aws.eks.audit.*`.
 60
 61Enable the `audit` control-plane log type on the EKS cluster, send its
 62CloudWatch log group through the AWS integration, and confirm events carry
 63`data_stream.dataset: aws.eks_audit` and
 64`cloud.provider: aws` before enabling this rule.
 65"""
 66severity = "medium"
 67tags = [
 68    "Domain: Cloud",
 69    "Domain: Containers",
 70    "Platform: AWS",
 71    "Platform: Kubernetes",
 72    "Data Source: AWS",
 73    "Data Source: Amazon Web Services",
 74    "Data Source: Kubernetes API Server Audit Logs",
 75    "Service: AWS EKS",
 76    "Use Case: Threat Detection",
 77    "Tactic: Privilege Escalation",
 78    "Tactic: Execution",
 79    "Rule Type: Custom Query (KQL)",
 80    "Resources: Investigation Guide",
 81    "Profile: Beta",
 82]
 83timestamp_override = "event.ingested"
 84type = "query"
 85
 86query = '''
 87data_stream.dataset:"aws.eks_audit" and
 88aws.eks.audit.objectRef.resource:"pods" and
 89aws.eks.audit.objectRef.subresource:"ephemeralcontainers" and
 90aws.eks.audit.verb:("update" or "patch") and
 91aws.eks.audit.annotations.authorization_k8s_io/decision:"allow" and
 92not user.name:(
 93  system\:node\:* or
 94  system\:serviceaccount\:kube-system\:*
 95)
 96'''
 97
 98
 99[[rule.threat]]
100framework = "MITRE ATT&CK"
101[[rule.threat.technique]]
102id = "T1611"
103name = "Escape to Host"
104reference = "https://attack.mitre.org/techniques/T1611/"
105
106
107[rule.threat.tactic]
108id = "TA0004"
109name = "Privilege Escalation"
110reference = "https://attack.mitre.org/tactics/TA0004/"
111[[rule.threat]]
112framework = "MITRE ATT&CK"
113[[rule.threat.technique]]
114id = "T1609"
115name = "Container Administration Command"
116reference = "https://attack.mitre.org/techniques/T1609/"
117
118
119[rule.threat.tactic]
120id = "TA0002"
121name = "Execution"
122reference = "https://attack.mitre.org/tactics/TA0002/"