Kubernetes Audit: Sidecar Injection via kubectl patch on Deployments

title: "Kubernetes Audit: Sidecar Injection via kubectl patch on Deployments"
id: 40ee8af4-2503-48dc-ae5a-b48842a53641
status: test
description: This rule flags Kubernetes API audit events where the PATCH verb targets resources under apps/v1 Deployments. Sidecar injection can be used to add an additional container to an existing pod, enabling execution of unauthorized code within a legitimate workload context. The detection relies on Kubernetes audit telemetry capturing the API verb and target object reference in the request.
references:
  - https://kubernetes.io/docs/tasks/manage-kubernetes-objects/update-api-object-kubectl-patch
  - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Sidecar%20Injection/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/kubernetes/audit/kubernetes_audit_sidecar_injection.yml
author: Leo Tsaousis (@laripping), Huntrule Team
date: 2024-03-26
tags:
  - attack.t1609
  - attack.execution
logsource:
  category: application
  product: kubernetes
  service: audit
detection:
  selection:
    verb: patch
    apiGroup: apps
    objectRef.resource: deployments
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: ad9012a6-e518-4432-9890-f3b82b8fc71f
    type: derived