Kubernetes Pod Container Exec via Kubernetes API (Remote Command Execution)

Detects Pod container exec session creation in Kubernetes audit logs, which can enable remote command execution.

FreeUnreviewedSigmamediumv1

kubernetes-pod-container-exec-via-kubernetes-api-remote-command-execution-a1b0ca4e

title: Kubernetes Pod Container Exec via Kubernetes API (Remote Command Execution)
id: a6a94301-016b-43f6-b42e-55e6dd24c58d
status: test
description: This rule flags Kubernetes API requests that create an exec session against a Pod container (objectRef resource=pods and subresource=exec). Attackers can use this behavior to run commands inside existing containers for remote control or follow-on actions. Detection relies on Kubernetes audit log events that record the request verb, target resource, and exec subresource.
references:
  - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Exec%20into%20container/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/kubernetes/audit/kubernetes_audit_exec_into_container.yml
author: Leo Tsaousis (@laripping), Huntrule Team
date: 2024-03-26
tags:
  - attack.t1609
  - attack.execution
logsource:
  category: application
  product: kubernetes
  service: audit
detection:
  selection:
    verb: create
    objectRef.resource: pods
    objectRef.subresource: exec
  condition: selection
falsepositives:
  - Legitimate debugging activity. Investigate the identity performing the requests and their authorization.
level: medium
license: DRL-1.1
related:
  - id: a1b0ca4e-7835-413e-8471-3ff2b8a66be6
    type: derived

What it detects

This rule flags Kubernetes API requests that create an exec session against a Pod container (objectRef resource=pods and subresource=exec). Attackers can use this behavior to run commands inside existing containers for remote control or follow-on actions. Detection relies on Kubernetes audit log events that record the request verb, target resource, and exec subresource.

Known false positives

Legitimate debugging activity. Investigate the identity performing the requests and their authorization.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.