Cloud Credential Search Detected via Defend for Containers

  1[metadata]
  2creation_date = "2023/05/12"
  3integration = ["cloud_defend"]
  4maturity = "production"
  5min_stack_comments = "Defend for Containers integration was re-introduced in 9.3.0"
  6min_stack_version = "9.3.0"
  7updated_date = "2026/09/18"
  8
  9[rule]
 10author = ["Elastic"]
 11description = """
 12This rule detects the use of system search utilities like grep and find to search for AWS credentials inside a
 13container. Unauthorized access to these sensitive files could lead to further compromise of the container
 14environment or facilitate a container breakout to the underlying cloud environment.
 15"""
 16from = "now-6m"
 17index = ["logs-cloud_defend.process*"]
 18interval = "5m"
 19language = "eql"
 20license = "Elastic License v2"
 21name = "Cloud Credential Search Detected via Defend for Containers"
 22references = ["https://sysdig.com/blog/threat-detection-aws-cloud-containers/"]
 23risk_score = 47
 24rule_id = "d0b0f3ed-0b37-44bf-adee-e8cb7de92767"
 25severity = "medium"
 26tags = [
 27    "Data Source: Elastic Defend for Containers",
 28    "Domain: Containers",
 29    "OS: Linux",
 30    "Use Case: Threat Detection",
 31    "Tactic: Credential Access",
 32    "Resources: Investigation Guide",
 33    "Noise: Unknown",
 34    "Performance: Fast",
 35    "Rule Type: Event Correlation (EQL)",
 36    "Platform: Linux",
 37]
 38timestamp_override = "event.ingested"
 39type = "eql"
 40query = '''
 41process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and (
 42  process.name in ("grep", "egrep", "fgrep", "find", "locate", "mlocate", "cat", "sed", "awk") or
 43  (
 44    /* Account for tools that execute utilities as a subprocess, in this case the target utility name will appear as a process arg */
 45    process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "busybox") and
 46    process.args in (
 47      "grep", "/bin/grep", "/usr/bin/grep", "/usr/local/bin/grep",
 48      "egrep", "/bin/egrep", "/usr/bin/egrep", "/usr/local/bin/egrep",
 49      "fgrep", "/bin/fgrep", "/usr/bin/fgrep", "/usr/local/bin/fgrep",
 50      "find", "/bin/find", "/usr/bin/find", "/usr/local/bin/find",
 51      "locate", "/bin/locate", "/usr/bin/locate", "/usr/local/bin/locate",
 52      "mlocate", "/bin/mlocate", "/usr/bin/mlocate", "/usr/local/bin/mlocate",
 53      "cat", "/bin/cat", "/usr/bin/cat", "/usr/local/bin/cat",
 54      "sed", "/bin/sed", "/usr/bin/sed", "/usr/local/bin/sed",
 55      "awk", "/bin/awk", "/usr/bin/awk", "/usr/local/bin/awk"
 56    ) and 
 57    /* default exclusion list to not FP on default multi-process commands */
 58    not process.args in (
 59      "which", "/bin/which", "/usr/bin/which", "/usr/local/bin/which",
 60      "man", "/bin/man", "/usr/bin/man", "/usr/local/bin/man",
 61      "chmod", "/bin/chmod", "/usr/bin/chmod", "/usr/local/bin/chmod",
 62      "chown", "/bin/chown", "/usr/bin/chown", "/usr/local/bin/chown"
 63    )
 64  )
 65)
 66and
 67process.args like~ (
 68  /* AWS Credentials */
 69  "*aws_access_key_id*", "*aws_secret_access_key*", "*aws_session_token*", "*accesskeyid*", "*secretaccesskey*",
 70  "*access_key*", "*.aws/credentials*",
 71
 72  /* Azure Credentials */
 73  "*AZURE_CLIENT_ID*", "*AZURE_TENANT_ID*", "*AZURE_CLIENT_SECRET*", "*AZURE_FEDERATED_TOKEN_FILE*",
 74  "*IDENTITY_ENDPOINT*", "*IDENTITY_HEADER*", "*MSI_ENDPOINT*", "*MSI_SECRET*",
 75  "*/.azure/*", "*/var/run/secrets/azure/*",
 76
 77  /* GCP Credentials */
 78  "*/.config/gcloud/*", "*application_default_credentials.json*",
 79  "*type: service_account*", "*client_email*", "*private_key_id*", "*private_key*",
 80  "*/var/run/secrets/google/*", "*GOOGLE_APPLICATION_CREDENTIALS*"
 81) and container.id like "*" 
 82'''
 83
 84[[rule.threat]]
 85framework = "MITRE ATT&CK"
 86
 87[[rule.threat.technique]]
 88id = "T1552"
 89name = "Unsecured Credentials"
 90reference = "https://attack.mitre.org/techniques/T1552/"
 91
 92[[rule.threat.technique.subtechnique]]
 93id = "T1552.001"
 94name = "Credentials In Files"
 95reference = "https://attack.mitre.org/techniques/T1552/001/"
 96
 97[rule.threat.tactic]
 98id = "TA0006"
 99name = "Credential Access"
100reference = "https://attack.mitre.org/tactics/TA0006/"
101
102[[rule.threat]]
103framework = "MITRE ATT&CK"
104
105[[rule.threat.technique]]
106id = "T1083"
107name = "File and Directory Discovery"
108reference = "https://attack.mitre.org/techniques/T1083/"
109
110[rule.threat.tactic]
111id = "TA0007"
112name = "Discovery"
113reference = "https://attack.mitre.org/tactics/TA0007/"