Potential Remote Command Execution In Pod Container

Title: Potential Remote Command Execution In Pod Container
Status: test
Description:Detects attempts to execute remote commands, within a Pod's container using e.g. the "kubectl exec" command.
References:
  -https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Exec%20into%20container/
Author: Leo Tsaousis (@laripping)
Date: 2024-03-26
modified:None
Tags:

• -'attack.t1609'
• -'attack.execution'

Logsource:

• category: application
• product: kubernetes
• service: audit

Detection:
  selection:
    verb: 'create'
    objectRef.resource: 'pods'
    objectRef.subresource: 'exec'
  condition:selection
Falsepositives:
  -Legitimate debugging activity. Investigate the identity performing the requests and their authorization.
Level: medium