Kubernetes Pod exec via API creates exec subresource requests
Detects Pod container exec session creation in Kubernetes audit logs, which can enable remote command execution.
- Product
- kubernetes
- Category
- application
- Author
- Leo Tsaousis (@laripping) (SigmaHQ), DRL 1.1
- Published
- 2024-03-26
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule catches Kubernetes API requests that create the pods/exec subresource, which corresponds to executing commands inside a container (e.g., kubectl exec). Attackers can use this capability to run arbitrary commands in the context of a Pod, potentially enabling persistence, data access, or lateral movement. It relies on Kubernetes audit logs capturing a create verb on the pods exec subresource and the associated target object references.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Kubernetes Pod exec via API creates exec subresource requests
id: a6a94301-016b-43f6-b42e-55e6dd24c58d
status: test
description: This rule catches Kubernetes API requests that create the pods/exec subresource, which corresponds to executing commands inside a container (e.g., kubectl exec). Attackers can use this capability to run arbitrary commands in the context of a Pod, potentially enabling persistence, data access, or lateral movement. It relies on Kubernetes audit logs capturing a create verb on the pods exec subresource and the associated target object references.
references:
- https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Exec%20into%20container/
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/kubernetes/audit/kubernetes_audit_exec_into_container.yml
author: Leo Tsaousis (@laripping), Huntrule Team
date: 2024-03-26
tags:
- attack.t1609
- attack.execution
logsource:
category: application
product: kubernetes
service: audit
detection:
selection:
verb: create
objectRef.resource: pods
objectRef.subresource: exec
condition: selection
falsepositives:
- Legitimate debugging activity. Investigate the identity performing the requests and their authorization.
level: medium
license: DRL-1.1
related:
- id: a1b0ca4e-7835-413e-8471-3ff2b8a66be6
type: derived