Kubernetes Audit: Sidecar Injection via kubectl patch to Deployments
Detects PATCH operations against Kubernetes Deployments that may indicate sidecar-style container injection.
- Product
- kubernetes
- Category
- application
- Author
- Leo Tsaousis (@laripping) (SigmaHQ), DRL 1.1
- Published
- 2024-03-26
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Kubernetes API audit events where a PATCH is issued in the apps API group targeting deployments, which can be used to modify running workloads to add containers. Sidecar-style additions may allow an attacker to run additional code alongside existing containers without creating a separate, clearly distinguishable pod. It relies on Kubernetes audit telemetry capturing the API verb, API group, and the deployment resource reference for the patch request.
Reporting behind it
- kubernetes.iohttps://kubernetes.io/docs/tasks/manage-kubernetes-objects/update-api-object-kubectl-patch
- microsoft.github.iohttps://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Sidecar%20Injection/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/application/kubernetes/audit/kubernetes_audit_sidecar_injection.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Kubernetes Audit: Sidecar Injection via kubectl patch to Deployments"
id: 40ee8af4-2503-48dc-ae5a-b48842a53641
status: test
description: This rule flags Kubernetes API audit events where a PATCH is issued in the apps API group targeting deployments, which can be used to modify running workloads to add containers. Sidecar-style additions may allow an attacker to run additional code alongside existing containers without creating a separate, clearly distinguishable pod. It relies on Kubernetes audit telemetry capturing the API verb, API group, and the deployment resource reference for the patch request.
references:
- https://kubernetes.io/docs/tasks/manage-kubernetes-objects/update-api-object-kubectl-patch
- https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Sidecar%20Injection/
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/kubernetes/audit/kubernetes_audit_sidecar_injection.yml
author: Leo Tsaousis (@laripping), Huntrule Team
date: 2024-03-26
tags:
- attack.t1609
- attack.execution
logsource:
category: application
product: kubernetes
service: audit
detection:
selection:
verb: patch
apiGroup: apps
objectRef.resource: deployments
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: ad9012a6-e518-4432-9890-f3b82b8fc71f
type: derived