Azure AKS Ephemeral Container Added to Pod

  1[metadata]
  2creation_date = "2026/07/09"
  3integration = ["azure"]
  4maturity = "production"
  5updated_date = "2026/07/09"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects an identity injecting an ephemeral (debug) container into a running AKS (Azure Kubernetes Service) pod via the
 11pods/ephemeralcontainers subresource, excluding known AKS control-plane and platform identities. Ephemeral containers
 12share the target pod's namespaces and give stealthy interactive access to its processes and mounted secrets without
 13creating a new pod. Coverage includes workload service accounts (system:serviceaccount:*), so a compromised in-cluster
 14token used to attach a debug container is not excluded.
 15"""
 16false_positives = [
 17    """
 18    Operators and support tooling use ephemeral containers (kubectl debug) for legitimate troubleshooting. Baseline
 19    expected users and exclude verified break-glass or platform identities after review.
 20    """,
 21]
 22from = "now-9m"
 23index = ["logs-azure.platformlogs-*"]
 24language = "kuery"
 25license = "Elastic License v2"
 26name = "Azure AKS Ephemeral Container Added to Pod"
 27note = """## Triage and analysis
 28
 29### Investigating Azure AKS Ephemeral Container Added to Pod
 30
 31AKS kube-audit events are carried under the flattened `azure.platformlogs.properties.log.*` subtree and share the ARM
 32operation `event.action: Microsoft.ContainerService/managedClusters/diagnosticLogs/Read`. An ephemeral container is
 33attached to a running pod (via `kubectl debug`) and shares that pod's process and network namespaces. Adversaries use it
 34as a stealthier alternative to `exec` to read mounted secrets and interact with the workload.
 35
 36### Possible investigation steps
 37
 38- Identify the acting identity in `azure.platformlogs.properties.log.user.username` (and its groups in
 39  `azure.platformlogs.properties.log.user.groups`) and whether it should debug pods. A username of `masterclient` with
 40  the `system:masters` group is the AKS local cluster-admin certificate (`az aks get-credentials --admin`); on clusters
 41  with local accounts disabled it should not appear at all, so its presence is itself notable. Entra-integrated admins
 42  appear as their UPN/objectId instead.
 43- Inspect the injected container in the `azure.platformlogs.properties.log.requestObject.spec.ephemeralContainers.*`
 44  fields: the `image`, `command`, and `targetContainerName` show what was run and against which container, and
 45  `securityContext.capabilities.add` (e.g. `SYS_PTRACE`, `SYS_ADMIN`) or a privileged context indicates offensive
 46  debugging.
 47- Review `azure.platformlogs.properties.log.userAgent` to distinguish an interactive `kubectl debug` from automation or
 48  custom tooling, and `azure.platformlogs.properties.log.responseStatus.code` to tell a successful injection (200) from
 49  a denied attempt (403) by an identity lacking RBAC.
 50- Identify the target pod in `azure.platformlogs.properties.log.objectRef.name` /
 51  `azure.platformlogs.properties.log.objectRef.namespace`.
 52- Evaluate the source in `azure.platformlogs.properties.log.sourceIPs` and pivot on it for related exec sessions, secret
 53  reads, or RBAC changes.
 54
 55### False positive analysis
 56
 57- Operators and support tooling use ephemeral containers for legitimate troubleshooting; baseline expected users and
 58  exclude verified break-glass or platform identities.
 59
 60### Response and remediation
 61
 62- If unauthorized, remove the ephemeral container (delete or replace the pod), revoke the acting identity's tokens, and
 63  review the RBAC that permitted the injection.
 64- Inspect the target pod for accessed secrets or tampering and rotate any exposed credentials.
 65- Collect kube-audit and identity artifacts per incident response procedures.
 66"""
 67references = [
 68    "https://kubernetes.io/docs/tasks/debug/debug-application/debug-running-pod/#ephemeral-container",
 69    "https://microsoft.github.io/Threat-Matrix-for-Kubernetes/",
 70    "https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/",
 71]
 72risk_score = 47
 73rule_id = "d4209683-ee18-439f-b816-1bbe6ee6bbc8"
 74setup = """The Azure Fleet integration collecting AKS diagnostic logs forwarded through Event Hub into the `azure.platformlogs`
 75data stream is required for this rule. Enable either the `kube-audit` or the `kube-audit-admin` log category (Microsoft
 76recommends `kube-audit-admin` alone to reduce volume, as it only drops read-only get/list events). Mutating
 77ephemeral-container writes are recorded in both categories with the same `auditID`, so clusters that enable both
 78categories may generate two alerts per injection.
 79"""
 80severity = "medium"
 81tags = [
 82    "Domain: Cloud",
 83    "Domain: Kubernetes",
 84    "Data Source: Azure",
 85    "Data Source: Azure Platform Logs",
 86    "Data Source: Kubernetes",
 87    "Use Case: Threat Detection",
 88    "Tactic: Execution",
 89    "Resources: Investigation Guide",
 90]
 91timestamp_override = "event.ingested"
 92type = "query"
 93
 94query = '''
 95data_stream.dataset:azure.platformlogs and
 96  event.action:"Microsoft.ContainerService/managedClusters/diagnosticLogs/Read" and
 97  azure.platformlogs.category:("kube-audit" or "kube-audit-admin") and
 98  azure.platformlogs.properties.log.stage:"ResponseComplete" and
 99  azure.platformlogs.properties.log.objectRef.resource:"pods" and
100  azure.platformlogs.properties.log.objectRef.subresource:"ephemeralcontainers" and
101  azure.platformlogs.properties.log.verb:("update" or "patch") and
102  not azure.platformlogs.properties.log.user.username:(
103    system\:node\:* or "aksService" or "hcpService" or "readinessChecker" or
104    system\:serviceaccount\:kube-system\:*
105  )
106'''
107
108
109[[rule.threat]]
110framework = "MITRE ATT&CK"
111[[rule.threat.technique]]
112id = "T1610"
113name = "Deploy Container"
114reference = "https://attack.mitre.org/techniques/T1610/"
115
116
117[rule.threat.tactic]
118id = "TA0002"
119name = "Execution"
120reference = "https://attack.mitre.org/tactics/TA0002/"
121
122[rule.investigation_fields]
123field_names = [
124    "@timestamp",
125    "event.action",
126    "azure.platformlogs.category",
127    "azure.platformlogs.properties.log.verb",
128    "azure.platformlogs.properties.log.user.username",
129    "azure.platformlogs.properties.log.user.groups",
130    "azure.platformlogs.properties.log.userAgent",
131    "azure.platformlogs.properties.log.sourceIPs",
132    "azure.platformlogs.properties.log.objectRef.namespace",
133    "azure.platformlogs.properties.log.objectRef.name",
134    "azure.platformlogs.properties.log.objectRef.subresource",
135    "azure.platformlogs.properties.log.requestObject.spec.ephemeralContainers.name",
136    "azure.platformlogs.properties.log.requestObject.spec.ephemeralContainers.image",
137    "azure.platformlogs.properties.log.requestObject.spec.ephemeralContainers.command",
138    "azure.platformlogs.properties.log.requestObject.spec.ephemeralContainers.targetContainerName",
139    "azure.platformlogs.properties.log.requestObject.spec.ephemeralContainers.securityContext.capabilities.add",
140    "azure.platformlogs.properties.log.responseStatus.code",
141]