Kubernetes Exec Into Pod Detection Scenario by crowdsecurity | CrowdSec Hub

Kubernetes Exec Into Pod

Attack scenariok8s:auditMITRE T1609

By: crowdsecurity
Version: 0.4
Name: crowdsecurity/k8s-audit-pod-exec

Detect execution (via kubectl exec) in pods

Install with a top-level collection

1 collection include it

sudo cscli collections install crowdsecurity/k8s-audit

Installs 1 parser and 7 scenarios.

View Kubernetes - Audit Detection →

Installation

sudo cscli scenarios install crowdsecurity/k8s-audit-pod-exec

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/k8s-audit-pod-exec.yaml· 20 linesGitHub

1type: trigger1
2name: crowdsecurity/k8s-audit-pod-exec
3description: "Detect execution (via kubectl exec) in pods"
4filter: |2
5  evt.Meta.log_type == 'k8s-audit' &&
6  (
7   (evt.Meta.datasource_type == "k8s-audit" && evt.Unmarshaled.k8s_audit.ObjectRef?.Resource == 'pods' && evt.Unmarshaled.k8s_audit.ObjectRef?.Subresource == 'exec')
8   ||
9   (evt.Meta.datasource_type != "k8s-audit" && evt.Unmarshaled.k8s_audit.objectRef?.resource == 'pods' && evt.Unmarshaled.k8s_audit.objectRef?.subresource == 'exec')
10  )
11labels:
12  notification: true
13  classification:3
14    - attack.T1609
15  behavior: "k8s:audit"
16  label: "Kubernetes Exec Into Pod"
17  spoofable: 0
18  confidence: 3
19  cti: false
20  service: k8s

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Detects execution (via kubectl exec) in pods.

The scenario needs logs from the pods resources at the Metadata level at a minimum.

No decision will be taken based on this scenario, it is only intended for notification purposes.