Potential Sidecar Injection Into Running Deployment

calendar Jun 4, 2025 · attack.t1609 attack.execution  ·
Share on: linkedin copy

Detects attempts to inject a sidecar container into a running deployment. A sidecar container is an additional container within a pod, that resides alongside the main container. One way to add containers to running resources like Deployments/DeamonSets/StatefulSets, is via a "kubectl patch" operation. By injecting a new container within a legitimate pod, an attacker can run their code and hide their activity, instead of running their own separated pod in the cluster.

Sigma rule (View on GitHub)

 1title: Potential Sidecar Injection Into Running Deployment
 2id: ad9012a6-e518-4432-9890-f3b82b8fc71f
 3status: test
 4description: |
 5    Detects attempts to inject a sidecar container into a running deployment.
 6    A sidecar container is an additional container within a pod, that resides alongside the main container.
 7    One way to add containers to running resources like Deployments/DeamonSets/StatefulSets, is via a "kubectl patch" operation.
 8    By injecting a new container within a legitimate pod, an attacker can run their code and hide their activity, instead of running their own separated pod in the cluster.    
 9references:
10    - https://kubernetes.io/docs/tasks/manage-kubernetes-objects/update-api-object-kubectl-patch
11    - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Sidecar%20Injection/
12author: Leo Tsaousis (@laripping)
13date: 2024-03-26
14tags:
15    - attack.t1609
16    - attack.execution
17logsource:
18    category: application
19    product: kubernetes
20    service: audit
21detection:
22    selection:
23        verb: 'patch'
24        apiGroup: 'apps'
25        objectRef.resource: 'deployments'
26    condition: selection
27falsepositives:
28    - Unknown
29level: medium

References

Related rules

to-top