MITRE ATT&CK technique
Container Administration Command detection rulesT1609
Container Administration Command (T1609) is a MITRE ATT&CK technique in the Execution tactic. This page lists the 3 community-maintained Sigma detection rules in the library mapped to T1609 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target kubernetes.
Top products
Tactic
Kubernetes Potential Enumeration Activity
mediumDetects potential Kubernetes enumeration or attack activity via the audit log. This includes the execution of common shells, utilities, or specialized tools like 'Rakkess' (access_matrix) and 'TruffleHog' via Kubernetes API requests. Attackers use these methods to perform reconnaissance (enumeration), secret harvesting, or execute code (exec) within a cluster.
kubernetes
Potential Remote Command Execution In Pod Container
mediumDetects attempts to execute remote commands, within a Pod's container using e.g. the "kubectl exec" command.
kubernetes · application
Potential Sidecar Injection Into Running Deployment
mediumDetects attempts to inject a sidecar container into a running deployment. A sidecar container is an additional container within a pod, that resides alongside the main container. One way to add containers to running resources like Deployments/DeamonSets/StatefulSets, is via a "kubectl patch" operation. By injecting a new container within a legitimate pod, an attacker can run their code and hide their activity, instead of running their own separated pod in the cluster.
kubernetes · application