Possible Sidecar Injection Into Running Deployment (via application)

title: Possible Sidecar Injection Into Running Deployment (via application)
id: 8d84239e-b0d5-57ce-8fcc-fa2e10996de9
status: stable
description: This rule detects attempts to inject a sidecar container into a running deployment. A sidecar container is an additional container within a pod, that resides alongside the main container. One way to add containers to running resources like Deployments/DeamonSets/StatefulSets, is via a "kubectl patch" operation. By injecting a new container within a legitimate pod, an adversary can run their code and hide their activity, instead of running their own separated pod in the cluster.
references:
    - https://attack.mitre.org/techniques/T1609/
    - https://kubernetes.io/docs/tasks/manage-kubernetes-objects/update-api-object-kubectl-patch
    - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Sidecar%20Injection/
author: Huntrule Team
date: 2026-03-24
tags:
    - attack.t1609
    - attack.execution
logsource:
    category: application
    product: kubernetes
    service: audit
detection:
    selection:
        verb: 'patch'
        apiGroup: 'apps'
        objectRef.resource: 'deployments'
    condition: selection
falsepositives:
    - Unknown
level: medium