Possible Remote Command Execution In Pod Container (via application)

title: Possible Remote Command Execution In Pod Container (via application)
id: 9f1274a8-8082-5604-b34c-c1ee1791ba07
status: stable
description: This rule detects attempts to execute remote commands, within a Pod's container using e.g. the "kubectl exec" command.
references:
    - https://attack.mitre.org/techniques/T1609/
    - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Exec%20into%20container/
author: Huntrule Team
date: 2026-04-15
tags:
    - attack.t1609
    - attack.execution
logsource:
    category: application
    product: kubernetes
    service: audit
detection:
    selection:
        verb: 'create'
        objectRef.resource: 'pods'
        objectRef.subresource: 'exec'
    condition: selection
falsepositives:
    - Unknown
level: medium