Kubernetes Static Pod Manifest File Access

  1[metadata]
  2creation_date = "2026/05/06"
  3integration = ["endpoint", "auditd_manager"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects Linux process executions where shells, editors, interpreters, or file/stream utilities reference
 11/etc/kubernetes/manifests in process arguments. That directory holds static pod manifests read by the kubelet;
 12interaction via editors, downloaders, kubectl, redirection helpers (tee, dd), or scripting runtimes may indicate
 13staging or tampering with manifests for persistence or privileged workload placement. Pairs with file-telemetry rules
 14that flag direct manifest creation on container workloads.
 15"""
 16false_positives = [
 17    """
 18    Cluster provisioning (kubeadm), configuration management, or administrators editing manifests during maintenance may
 19    match. Baseline approved automation and interactive admin sessions on control plane nodes.
 20    """,
 21]
 22from = "now-9m"
 23index = ["auditbeat-*", "logs-auditd_manager.auditd-*", "logs-endpoint.events.process*"]
 24language = "kuery"
 25license = "Elastic License v2"
 26name = "Kubernetes Static Pod Manifest File Access"
 27note = """## Triage and analysis
 28
 29### Investigating Kubernetes Static Pod Manifest File Access
 30
 31Review the full command line (process.args, process.command_line), user.id, user.name, process.parent, and whether the
 32session was interactive. Confirm if the host is a Kubernetes node or admin jump host where manifest edits are expected.
 33
 34### Possible investigation steps
 35
 36- Compare activity to change windows and identity baselines; prioritize events without matching change tickets.
 37- Inspect subsequent process and file events on the same host for writes under /etc/kubernetes/manifests or kubelet
 38  restarts.
 39- Correlate with Kubernetes audit logs and node/agent telemetry for related compromise indicators.
 40
 41### Response and remediation
 42
 43- If unauthorized, restore manifests from known-good sources, isolate the host, and review cluster integrity per incident
 44  policy.
 45"""
 46references = [
 47    "https://kubernetes.io/docs/tasks/configure-pod-container/static-pod/",
 48    "https://attack.mitre.org/techniques/T1053/007/",
 49]
 50risk_score = 47
 51rule_id = "a698a653-e144-4e40-bade-35135935be45"
 52setup = """## Setup
 53
 54Requires **Elastic Defend** and/or **Auditd Manager** process telemetry (`logs-endpoint.events.process*`,
 55`logs-auditd_manager.auditd-*`, `auditbeat-*`) with command-line argument capture for exec events.
 56
 57### Elastic Defend
 58Install the Elastic Defend integration via Fleet on Linux hosts and use a policy that collects process events with
 59arguments.
 60
 61### Auditd Manager
 62Deploy Auditd Manager and ensure execve (or equivalent process) auditing is enabled so `process.args` and
 63`process.executable` populate for monitored binaries.
 64
 65See https://docs.elastic.co/integrations/auditd_manager
 66"""
 67severity = "medium"
 68tags = [
 69    "Data Source: Auditd Manager",
 70    "Data Source: Elastic Defend",
 71    "Domain: Endpoint",
 72    "Domain: Kubernetes",
 73    "Domain: Containers",
 74    "OS: Linux",
 75    "Use Case: Threat Detection",
 76    "Tactic: Persistence",
 77    "Tactic: Privilege Escalation",
 78    "Resources: Investigation Guide",
 79    "Noise: Low",
 80    "Performance: Normal",
 81    "Rule Type: Custom Query (KQL)",
 82    "Platform: Linux",
 83]
 84timestamp_override = "event.ingested"
 85type = "query"
 86query = '''
 87host.os.type:linux and event.category:process and event.action:(exec or executed) and 
 88process.name:(
 89  bash or sh or dash or zsh or 
 90  cat or cp or mv or touch or tee or dd or
 91  sed or awk or 
 92  curl or wget or scp or
 93  vi or vim or nano or echo or
 94  busybox or
 95  python* or perl* or ruby* or node or lua* or
 96  openssl or base64 or xxd or
 97  .*) and 
 98  process.args:(*/etc/kubernetes/manifests/* and not (/etc/kubernetes/manifests/etcd* or /etc/kubernetes/manifests/kube-apiserver* or /etc/kubernetes/manifests/kube-scheduler* or /etc/kubernetes/manifests/kube-controller-manager*)) and 
 99  not (process.args :printf* and process.working_directory :/home/*-svc-nessus) and 
100  not process.parent.executable :("/opt/nessus/sbin/nessusd" or "/opt/nessus_agent/sbin/nessus-agent-module")
101'''
102
103[[rule.threat]]
104framework = "MITRE ATT&CK"
105
106[[rule.threat.technique]]
107id = "T1053"
108name = "Scheduled Task/Job"
109reference = "https://attack.mitre.org/techniques/T1053/"
110
111[[rule.threat.technique.subtechnique]]
112id = "T1053.007"
113name = "Container Orchestration Job"
114reference = "https://attack.mitre.org/techniques/T1053/007/"
115
116[rule.threat.tactic]
117id = "TA0003"
118name = "Persistence"
119reference = "https://attack.mitre.org/tactics/TA0003/"
120
121[[rule.threat]]
122framework = "MITRE ATT&CK"
123
124[[rule.threat.technique]]
125id = "T1543"
126name = "Create or Modify System Process"
127reference = "https://attack.mitre.org/techniques/T1543/"
128
129[[rule.threat.technique.subtechnique]]
130id = "T1543.005"
131name = "Container Service"
132reference = "https://attack.mitre.org/techniques/T1543/005/"
133
134[rule.threat.tactic]
135id = "TA0004"
136name = "Privilege Escalation"
137reference = "https://attack.mitre.org/tactics/TA0004/"