Suspicious Interpreter Execution Detected via Defend for Containers

  1[metadata]
  2creation_date = "2026/02/06"
  3integration = ["cloud_defend"]
  4maturity = "production"
  5min_stack_comments = "Defend for Containers integration was re-introduced in 9.3.0"
  6min_stack_version = "9.3.0"
  7updated_date = "2026/09/18"
  8
  9[rule]
 10author = ["Elastic"]
 11description = """
 12This rule detects when a process executes a suspicious interpreter command inside a container.
 13These commands are commonly used by attackers to execute malicious code or exfiltrate data.
 14"""
 15from = "now-6m"
 16index = ["logs-cloud_defend.process*"]
 17interval = "5m"
 18language = "eql"
 19license = "Elastic License v2"
 20name = "Suspicious Interpreter Execution Detected via Defend for Containers"
 21note = """## Triage and analysis
 22
 23> **Disclaimer**:
 24> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 25
 26### Investigating Suspicious Interpreter Execution Detected via Defend for Containers
 27
 28This detection flags activity inside a Linux container launching Perl, PHP, Lua, Python, or Ruby with inline code execution and high-risk functions commonly used for spawning processes, decoding payloads, or opening network connections. It matters because attackers often abuse these one-liners to run malware or exfiltrate data without dropping files, blending into normal admin shell activity. A common pattern is a `python -c` one-liner that base64-decodes a second-stage script and executes it, then initiates an outbound socket for command-and-control.
 29
 30### Possible investigation steps
 31
 32- Review the full inline interpreter code and decode any embedded payloads (e.g., base64/zlib/rot13) to determine its intent, IOCs, and whether it fetches or launches a second stage.  
 33- Identify the originating interactive session and actor by correlating the container’s TTY/exec session metadata with orchestrator audit logs (e.g., Kubernetes exec/attach) to determine who/what initiated it and from where.  
 34- Assess whether the container image, entrypoint, and recent deployment changes are expected for this workload, and check for signs of container escape attempts or host access (mounted sockets, privileged flags, hostPath mounts).  
 35- Pivot from the alert time to related activity in the same container for child processes, file writes, cron/systemd modifications, and persistence artifacts that indicate follow-on actions beyond a one-liner.  
 36- Check for unexpected outbound connections or DNS lookups from the container around execution time, and validate any contacted domains/IPs against threat intel and known-good service dependencies.
 37
 38### False positive analysis
 39
 40- A developer or SRE opens an interactive shell in the container to troubleshoot and runs a quick inline one-liner (e.g., `python -c`/`php -r`/`ruby -e`) to test network connectivity, decode/transform a string (base64/zlib), or call a subprocess for diagnostics, which matches the suspicious function patterns.  
 41- During an interactive container exec session, an administrator performs emergency maintenance or incident response actions using an interpreter one-liner to fetch configuration/state, invoke system utilities, or validate service behavior (e.g., `socket.connect`, `os.system`, `curl_exec`, `IO.popen`), producing a benign but high-risk inline command signature.
 42
 43### Response and remediation
 44
 45- Quarantine the affected workload by scaling it to zero or cordoning the node and blocking egress for the namespace while preserving the pod and container filesystem for evidence capture.  
 46- Terminate the interactive session and kill the interpreter process tree, then collect the full command line, any decoded inline payload, and any retrieved scripts or binaries from the container for malware analysis.  
 47- Hunt and remove follow-on artifacts by searching the container for newly created executables, modified startup scripts, cron entries, webshells, or injected environment variables, and redeploy from a known-good image rather than “cleaning” the live container.  
 48- Rotate credentials and secrets exposed to the container (service account tokens, API keys, database passwords) and invalidate active sessions if the one-liner performed network calls, decoded payloads, or spawned subprocesses.  
 49- Escalate to the incident response team if the inline code includes base64/zlib decoding, establishes a socket connection, downloads a second stage, or any similar activity is observed across multiple pods/namespaces.  
 50- Harden against recurrence by restricting `exec/attach` access, enforcing least-privilege pod security (no privileged, no host mounts, read-only root filesystem), and using egress allowlists plus image signing/admission controls to block unauthorized images and interactive debug containers."""
 51references = [
 52    "https://flare.io/learn/resources/blog/teampcp-cloud-native-ransomware",
 53]
 54risk_score = 47
 55rule_id = "cd24c340-b778-44bd-ab69-2f739bd70ce1"
 56severity = "medium"
 57tags = [
 58    "Data Source: Elastic Defend for Containers",
 59    "Domain: Containers",
 60    "OS: Linux",
 61    "Use Case: Threat Detection",
 62    "Tactic: Execution",
 63    "Tactic: Command and Control",
 64    "Resources: Investigation Guide",
 65    "Noise: Low",
 66    "Performance: Fast",
 67    "Rule Type: Event Correlation (EQL)",
 68    "Platform: Linux",
 69]
 70timestamp_override = "event.ingested"
 71type = "eql"
 72query = '''
 73process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
 74process.parent.executable != null and (
 75  (
 76    process.executable like ("/bin/perl*", "/usr/bin/perl*", "/usr/local/bin/perl*") and
 77    process.args == "-e" and process.args like~ (
 78      "*system(*", "*exec(*", "*IO.popen(*", "*Open3.popen3(*", "*spawn(*", "*eval(*",
 79      "*load(*IO::*", "*load(*Marshal*", "*load(*Fiddle*", "*load(*Zlib*", "*load(*Base64*",
 80      "*zlib.inflate(*", "*zlib.deflate(*", "*zlib.decompress(*", "*zlib.uncompress(*", "*zlib.compress(*",
 81      "*Marshal.load(*", "*Fiddle.dlopen(*", "*Fiddle::Function.new(*", "*base64*", "*zlib*", 
 82      "*net/http*", "*socket.new*", "*open-uri*", "*pack(*"
 83    )
 84  ) or
 85  process.executable like ("/bin/php*", "/usr/bin/php*", "/usr/local/bin/php*") and
 86  process.args == "-r" and process.args like~ (
 87    "*exec(*", "*system(*", "*shell_exec(*", "*passthru(*", "*proc_open(*", "*pcntl_exec(*", "*popen(*", 
 88    "*eval(*", "*assert(*", "*create_function(*", "*preg_replace(*e*", "*include(*", "*require(*",
 89    "*base64_decode(*", "*gzinflate(*", "*gzuncompress(*", "*str_rot13(*", "*urldecode(*", "*chr(*", 
 90    "*ord(*", "*strrev(*", "*strtr(*", "*pack(*", "*unpack(*", "*curl_exec(*", "*curl_multi_exec(*",
 91    "*file_get_contents(*", "*fopen(*", "*fsockopen(*", "*pfsockopen(*", "*stream_socket_client(*",
 92    "*socket_create(*", "*socket_connect(*", "*socket_write(*", "*socket_read(*", "*mail(*",
 93    "*move_uploaded_file(*"
 94  ) or
 95  process.executable like ("/bin/lua*", "/usr/bin/lua*", "/usr/local/bin/lua*") and
 96  process.args == "-e" and process.args like~ (
 97    "*os.execute(*", "*io.popen(*", "*load(*", "*loadstring(*", "*require(*", "*dofile(*",
 98    "*package.loadlib(*", "*base64.decode(*", "*base64.encode(*", "*zlib.inflate(*",
 99    "*zlib.deflate(*", "*zlib.decompress(*", "*zlib.compress(*", "*socket.bind(*",
100    "*socket.connect(*", "*socket.receive(*", "*socket.send(*", "*socket.tcp(*",
101    "*socket.udp(*", "*socket.listen(*", "*socket.accept(*", "*net.http.request(*",
102    "*net.http.get(*", "*net.http.post(*", "*http.request(*", "*http.get(*", "*http.post(*"
103  ) or
104  process.executable like ("/bin/python*", "/usr/bin/python*", "/usr/local/bin/python*") and
105  process.args == "-c" and process.args like~ (
106    "*exec(*base64*", "*exec(*decode(*", "*exec(*marshal*", "*exec(*pickle*", "*eval(*exec(*",
107    "*eval(*", "*subprocess.popen(*", "*subprocess.run(*", "*pickle.loads(*", "*marshal.loads(*",
108    "*binascii*", "*os.system(*", "*os.popen(*", "*pty.*", "*dup2*", "*fileno()*", "*connect(*",
109    "*bind(*", "*execve(*", "*base64*", "*base32*", "*base16*", "*base85*", "*decode(*",
110    "*zlib.*", "*[::-1]*", "*socket.socket(*", "*socket.connect(*", "*socket.bind(*"
111  ) or
112  process.executable like ("/bin/ruby*", "/usr/bin/ruby*", "/usr/local/bin/ruby*") and
113  process.args like "-e*" and process.args like~ (
114    "*system(*", "*exec(*", "*IO.popen(*", "*Open3.popen3(*", "*spawn(*", "*eval(*", "*load(*",
115    "*Marshal.load(*", "*Fiddle.dlopen(*", "*Fiddle::Function.new(*", "*base64*", "*zlib*", 
116    "*net/http*", "*socket*", "*open-uri*", "*pack(*", "*unpack(*"
117  )
118) and container.id like "?*"
119'''
120
121[[rule.threat]]
122framework = "MITRE ATT&CK"
123
124[[rule.threat.technique]]
125id = "T1059"
126name = "Command and Scripting Interpreter"
127reference = "https://attack.mitre.org/techniques/T1059/"
128
129[[rule.threat.technique.subtechnique]]
130id = "T1059.004"
131name = "Unix Shell"
132reference = "https://attack.mitre.org/techniques/T1059/004/"
133
134[[rule.threat.technique.subtechnique]]
135id = "T1059.006"
136name = "Python"
137reference = "https://attack.mitre.org/techniques/T1059/006/"
138
139[[rule.threat.technique.subtechnique]]
140id = "T1059.011"
141name = "Lua"
142reference = "https://attack.mitre.org/techniques/T1059/011/"
143
144[rule.threat.tactic]
145id = "TA0002"
146name = "Execution"
147reference = "https://attack.mitre.org/tactics/TA0002/"
148
149[[rule.threat]]
150framework = "MITRE ATT&CK"
151
152[[rule.threat.technique]]
153id = "T1071"
154name = "Application Layer Protocol"
155reference = "https://attack.mitre.org/techniques/T1071/"
156
157[[rule.threat.technique.subtechnique]]
158id = "T1071.001"
159name = "Web Protocols"
160reference = "https://attack.mitre.org/techniques/T1071/001/"
161
162[[rule.threat.technique]]
163id = "T1095"
164name = "Non-Application Layer Protocol"
165reference = "https://attack.mitre.org/techniques/T1095/"
166
167[rule.threat.tactic]
168id = "TA0011"
169name = "Command and Control"
170reference = "https://attack.mitre.org/tactics/TA0011/"
171
172[[rule.threat]]
173framework = "MITRE ATT&CK"
174
175[[rule.threat.technique]]
176id = "T1140"
177name = "Deobfuscate/Decode Files or Information"
178reference = "https://attack.mitre.org/techniques/T1140/"
179
180[rule.threat.tactic]
181id = "TA0005"
182name = "Defense Evasion"
183reference = "https://attack.mitre.org/tactics/TA0005/"