This rule detects a user attempt to establish a shell session into a pod using the exec command. Using the exec command in a pod allows a user to establish a temporary shell session and execute any process/commands in the pod. An adversary may call bash to gain a persistent interactive shell which will allow access to any data the pod has permissions to, including secrets.
Rule type: query
Risk score: 47
Runs every: 5m
Maximum alerts per execution: 100
- Continuous Monitoring
Rule license: Elastic License v2
kubernetes.audit.objectRef.resource:"pods" and kubernetes.audit.objectRef.subresource:"exec"
Framework: MITRE ATT&CKTM