Azure AKS Kubelet Proxy to Command Execution Endpoint

  1[metadata]
  2creation_date = "2026/07/16"
  3integration = ["azure"]
  4maturity = "production"
  5updated_date = "2026/07/16"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects use of the AKS (Azure Kubernetes Service) API server nodes/proxy subresource to reach a node's Kubelet
 11command-execution endpoints (run, exec, attach, portforward, cri). Unlike benign monitoring that scrapes /metrics and
 12/stats, a request to these endpoints executes commands inside a pod on the node, the core of the kubeletctl and Peirates
 13lateral-movement technique. Even a GET to /exec is command execution because the Kubelet maps the WebSocket upgrade
 14handshake to the RBAC get verb, so nodes/proxy GET is sufficient for remote code execution.
 15"""
 16false_positives = [
 17    """
 18    Legitimate use of the Kubelet run/exec/attach/portforward endpoints via nodes/proxy is rare. Administrative
 19    debugging tools that proxy exec through the API server may match; baseline and exclude verified operators.
 20    """,
 21]
 22from = "now-9m"
 23index = ["logs-azure.platformlogs-*"]
 24language = "kuery"
 25license = "Elastic License v2"
 26name = "Azure AKS Kubelet Proxy to Command Execution Endpoint"
 27note = """## Triage and analysis
 28
 29### Investigating Azure AKS Kubelet Proxy to Command Execution Endpoint
 30
 31AKS kube-audit events are carried under the flattened `azure.platformlogs.properties.log.*` subtree and share the ARM
 32operation `event.action: Microsoft.ContainerService/managedClusters/diagnosticLogs/Read`. This rule keys on the Kubelet
 33endpoint in `azure.platformlogs.properties.log.requestURI`: `/proxy/run`, `/proxy/exec`, `/proxy/attach`,
 34`/proxy/portforward`, and `/proxy/cri` execute commands in a pod on the target node, whereas monitoring uses `/metrics`
 35and `/stats`. Any hit here is high-signal command execution regardless of the acting identity, including a stolen
 36monitoring service-account token.
 37
 38### Possible investigation steps
 39
 40- Confirm the endpoint and target in `azure.platformlogs.properties.log.requestURI` (the path encodes
 41  `/<endpoint>/<namespace>/<pod>/<container>`) and the acting identity in
 42  `azure.platformlogs.properties.log.user.username`.
 43- Evaluate `azure.platformlogs.properties.log.sourceIPs`. This is an array; for an externally operated attack the first
 44  element is the operator's real client IP and the trailing entry is the internal API-server/konnectivity hop
 45  (`172.31.x`). A first entry that is not the cluster's own egress is a strong signal.
 46- Determine what the target pod runs and what secrets or tokens it exposes, and whether the identity should reach the
 47  Kubelet at all.
 48- Correlate with prior recon (`/proxy/pods`, `/proxy/runningpods`) and follow-on RBAC changes, secret reads, or token
 49  requests from the same identity.
 50
 51### False positive analysis
 52
 53- Direct use of Kubelet exec endpoints via nodes/proxy is uncommon; validate any administrative debugging tool that
 54  proxies exec and exclude verified operators.
 55
 56### Response and remediation
 57
 58- Treat as active command execution on a node. Revoke the acting identity's tokens, isolate the affected node and pods,
 59  and rotate credentials reachable from them.
 60- Review the RBAC that granted `nodes/proxy` and remove it from workload identities that do not require it.
 61- Note that direct Kubelet access on port 10250 bypasses the API server and is not in kube-audit; a confirmed proxy exec
 62  may indicate broader Kubelet access.
 63- Collect kube-audit and identity artifacts per incident response procedures.
 64"""
 65references = [
 66    "https://horizon3.ai/attack-research/when-read-only-isnt-k8s-nodes-proxy-get-to-rce/",
 67    "https://stratus-red-team.cloud/attack-techniques/kubernetes/k8s.privilege-escalation.nodes-proxy/",
 68    "https://www.cyberark.com/resources/threat-research-blog/using-kubelet-client-to-attack-the-kubernetes-cluster",
 69    "https://microsoft.github.io/Threat-Matrix-for-Kubernetes/",
 70    "https://github.com/inguardians/peirates",
 71    "https://grahamhelton.com/blog/nodes-proxy-rce"
 72]
 73risk_score = 73
 74rule_id = "4223a0c2-2a96-4742-b6ec-2ce9fa0019ba"
 75setup = "The Azure Fleet integration collecting AKS diagnostic logs with the `kube-audit` category forwarded through Event Hub into the `azure.platformlogs` data stream is required for this rule."
 76severity = "high"
 77tags = [
 78    "Domain: Cloud",
 79    "Domain: Kubernetes",
 80    "Data Source: Azure",
 81    "Data Source: Azure Platform Logs",
 82    "Data Source: Kubernetes",
 83    "Use Case: Threat Detection",
 84    "Tactic: Execution",
 85    "Tactic: Lateral Movement",
 86    "Resources: Investigation Guide",
 87]
 88timestamp_override = "event.ingested"
 89type = "query"
 90
 91query = '''
 92data_stream.dataset:azure.platformlogs and
 93  event.action:"Microsoft.ContainerService/managedClusters/diagnosticLogs/Read" and
 94  azure.platformlogs.category:"kube-audit" and
 95  azure.platformlogs.properties.log.objectRef.resource:"nodes" and
 96  azure.platformlogs.properties.log.objectRef.subresource:"proxy" and
 97  azure.platformlogs.properties.log.requestURI:(
 98    */proxy/run/* or */proxy/exec* or */proxy/attach* or
 99    */proxy/portforward* or */proxy/portForward* or */proxy/cri/*
100  ) and
101  not azure.platformlogs.properties.log.user.username:(
102    system\:node\:* or "aksService" or "hcpService" or "readinessChecker"
103  )
104'''
105
106
107[[rule.threat]]
108framework = "MITRE ATT&CK"
109[[rule.threat.technique]]
110id = "T1609"
111name = "Container Administration Command"
112reference = "https://attack.mitre.org/techniques/T1609/"
113
114
115[rule.threat.tactic]
116id = "TA0002"
117name = "Execution"
118reference = "https://attack.mitre.org/tactics/TA0002/"
119[[rule.threat]]
120framework = "MITRE ATT&CK"
121[[rule.threat.technique]]
122id = "T1210"
123name = "Exploitation of Remote Services"
124reference = "https://attack.mitre.org/techniques/T1210/"
125
126
127[rule.threat.tactic]
128id = "TA0008"
129name = "Lateral Movement"
130reference = "https://attack.mitre.org/tactics/TA0008/"
131
132[rule.investigation_fields]
133field_names = [
134    "@timestamp",
135    "event.action",
136    "azure.platformlogs.category",
137    "azure.platformlogs.properties.log.verb",
138    "azure.platformlogs.properties.log.user.username",
139    "azure.platformlogs.properties.log.sourceIPs",
140    "azure.platformlogs.properties.log.requestURI",
141    "azure.platformlogs.properties.log.objectRef.name",
142    "azure.platformlogs.properties.log.responseStatus.code",
143]