This rule detects a user attempt to establish a shell session into a pod using the exec command. Using the exec command in a pod allows a user to establish a temporary shell session and execute any process/commands in the pod. An adversary may call bash to gain a persistent interactive shell which will allow access to any data the pod has permissions to, including secrets.
Rule type: query
Risk score: 47
Runs every: 5m
Maximum alerts per execution: 100
- Data Source: Kubernetes
- Tactic: Execution
Rule license: Elastic License v2
event.dataset : "kubernetes.audit_logs" and kubernetes.audit.annotations.authorization_k8s_io/decision:"allow" and kubernetes.audit.verb:"create" and kubernetes.audit.objectRef.resource:"pods" and kubernetes.audit.objectRef.subresource:"exec"
Framework: MITRE ATT&CKTM