Interactive Exec Command Launched Against A Running Container

 1[metadata]
 2creation_date = "2023/05/12"
 3integration = ["cloud_defend"]
 4maturity = "production"
 5updated_date = "2024/05/21"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10This rule detects interactive 'exec' events launched against a container using the 'exec' command. Using the 'exec'
11command in a pod allows a user to establish a temporary shell session and execute any process/command inside the
12container. This rule specifically targets higher-risk interactive commands that allow real-time interaction with a
13container's shell. A malicious actor could use this level of access to further compromise the container environment or
14attempt a container breakout.
15"""
16false_positives = [
17    """
18    An administrator may need to exec into a pod for a legitimate reason like debugging purposes. Containers built from
19    Linux and Windows OS images, tend to include debugging utilities. In this case, an admin may choose to run commands
20    inside a specific container with kubectl exec ${POD_NAME} -c ${CONTAINER_NAME} -- ${CMD} ${ARG1} ${ARG2} ...
21    ${ARGN}. For example, the following command can be used to look at logs from a running Cassandra pod: kubectl exec
22    cassandra --cat /var/log/cassandra/system.log . Additionally, the -i and -t arguments might be used to run a shell
23    connected to the terminal: kubectl exec -i -t cassandra -- sh
24    """,
25]
26from = "now-6m"
27index = ["logs-cloud_defend*"]
28interval = "5m"
29language = "eql"
30license = "Elastic License v2"
31name = "Interactive Exec Command Launched Against A Running Container"
32references = [
33    "https://kubernetes.io/docs/tasks/debug/debug-application/debug-running-pod/",
34    "https://kubernetes.io/docs/tasks/debug/debug-application/get-shell-running-container/",
35]
36risk_score = 73
37rule_id = "420e5bb4-93bf-40a3-8f4a-4cc1af90eca1"
38severity = "high"
39tags = [
40    "Data Source: Elastic Defend for Containers",
41    "Domain: Container",
42    "OS: Linux",
43    "Use Case: Threat Detection",
44    "Tactic: Execution",
45]
46timestamp_override = "event.ingested"
47type = "eql"
48
49query = '''
50process where container.id : "*" and event.type== "start" and 
51
52/* use of kubectl exec to enter a container */
53process.entry_leader.entry_meta.type : "container" and 
54
55/* process is the inital process run in a container */
56process.entry_leader.same_as_process== true and
57
58/* interactive process */
59process.interactive == true
60'''
61
62
63[[rule.threat]]
64framework = "MITRE ATT&CK"
65[[rule.threat.technique]]
66id = "T1059"
67name = "Command and Scripting Interpreter"
68reference = "https://attack.mitre.org/techniques/T1059/"
69[[rule.threat.technique.subtechnique]]
70id = "T1059.004"
71name = "Unix Shell"
72reference = "https://attack.mitre.org/techniques/T1059/004/"
73
74
75[[rule.threat.technique]]
76id = "T1609"
77name = "Container Administration Command"
78reference = "https://attack.mitre.org/techniques/T1609/"
79
80
81[rule.threat.tactic]
82id = "TA0002"
83name = "Execution"
84reference = "https://attack.mitre.org/tactics/TA0002/"