huntrule

Kubernetes Audit: Sidecar Injection via kubectl patch to Deployments

Detects PATCH operations against Kubernetes Deployments that may indicate sidecar-style container injection.

FreeReviewedSigma · Medium · v5
Product
kubernetes
Category
application
Author
Leo Tsaousis (@laripping) (SigmaHQ), DRL 1.1
Published
2024-03-26
Updated
2026-07-31
AnalysisDetection
title: "Kubernetes Audit: Sidecar Injection via kubectl patch to Deployments"
id: 40ee8af4-2503-48dc-ae5a-b48842a53641
status: test
description: This rule flags Kubernetes API audit events where a PATCH is issued in the apps API group targeting deployments, which can be used to modify running workloads to add containers. Sidecar-style additions may allow an attacker to run additional code alongside existing containers without creating a separate, clearly distinguishable pod. It relies on Kubernetes audit telemetry capturing the API verb, API group, and the deployment resource reference for the patch request.
references:
  - https://kubernetes.io/docs/tasks/manage-kubernetes-objects/update-api-object-kubectl-patch
  - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Sidecar%20Injection/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/kubernetes/audit/kubernetes_audit_sidecar_injection.yml
author: Leo Tsaousis (@laripping), Huntrule Team
date: 2024-03-26
tags:
  - attack.t1609
  - attack.execution
logsource:
  category: application
  product: kubernetes
  service: audit
detection:
  selection:
    verb: patch
    apiGroup: apps
    objectRef.resource: deployments
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: ad9012a6-e518-4432-9890-f3b82b8fc71f
    type: derived