Open
Conversation
Aegrah
added
OS: Linux
Rule: New
Contributor
Rule: New - GuidelinesThese guidelines serve as a reminder set of considerations when proposing a new rule. Documentation and Context
Rule Metadata Checks
New BBR Rules
Testing and Validation
|
1 similar comment
Contributor
Rule: New - GuidelinesThese guidelines serve as a reminder set of considerations when proposing a new rule. Documentation and Context
Rule Metadata Checks
New BBR Rules
Testing and Validation
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cloud Defend for Containers - New Detection Rules
This PR introduces 10 new detection rules and 4 rule updates for the Elastic Defend for Containers integration. These rules focus on detecting interactive threats within container environments, covering various tactics across the MITRE ATT&CK framework including Discovery, Execution, Defense Evasion, Command and Control, Credential Access, and Persistence.
Summary of Changes
New Detection Rules
1. Interactive File Download Detected via Defend for Containers
File:
command_and_control_interactive_file_download_from_internet.tomlSeverity: Medium | Risk Score: 47
Description:
Detects when files are downloaded inside a container using
curlorwgetcommand-line tools during an interactive session. Adversaries commonly use these tools to download malicious payloads, establish C2 communication channels, or exfiltrate sensitive data.Why it's relevant:
Containers should typically have pre-built dependencies. Interactive file downloads indicate potential post-exploitation activity where an attacker is staging additional tools or malware.
MITRE ATT&CK:
2. Shell Command-Line History Deletion Detected via Defend for Containers
File:
defense_evasion_deletion_of_shell_cmdline_history.tomlSeverity: High | Risk Score: 73
Description:
Detects deletion or manipulation of shell command-line history files (
.bash_history,.sh_history,.zsh_history) inside containers. This includes direct file deletion, truncation, symlinking to/dev/null, or using shell built-ins likehistory -candunset HISTFILE.Why it's relevant:
Attackers frequently clear command history to cover their tracks after executing malicious commands. This is a classic anti-forensics technique that indicates an attacker is trying to hide their activity.
MITRE ATT&CK:
3. Interactive Process Execution from Suspicious Directory Detected via Defend for Containers
File:
defense_evasion_interactive_process_execution_from_suspicious_directory.tomlSeverity: High | Risk Score: 73
Description:
Detects execution of interactive processes from world-writable or temporary directories such as
/tmp,/dev/shm,/var/tmp,/run,/var/run,/mnt,/media, and/boot.Why it's relevant:
These directories are commonly used by attackers to stage and execute malicious binaries because they're typically writable and may not be monitored as closely as standard binary locations.
MITRE ATT&CK:
4. Potential Defense Evasion via Encoded Payload Detected via Defend for Containers
File:
defense_evasion_potential_evasion_via_encoded_payload.tomlSeverity: Medium | Risk Score: 47
Description:
Detects interactive execution of base64/encoding tools and interpreters with decode flags inside containers. Covers
base64,xxd,openssl enc, and scripting languages (Python, Perl, Ruby) executing decode operations.Why it's relevant:
Attackers frequently encode payloads to bypass security controls and obfuscate malicious commands. Decoding operations in interactive sessions often indicate payload execution or data exfiltration.
MITRE ATT&CK:
5. Kubelet Pod Discovery via Built-In Utilities Detected via Defend for Containers
File:
discovery_kubelet_pod_discovery_via_builtin_utilities.tomlSeverity: Low | Risk Score: 21
Description:
Detects use of common utilities (
du,nice,find,locate,ls) to enumerate pod information in/var/lib/kubelet/pods/. Uses a sequence query requiring 5 runs within 5 seconds to reduce false positives.Why it's relevant:
The kubelet pods directory contains sensitive information about running pods. Enumeration of this directory can reveal pod names, volumes, and service account tokens that can be leveraged for lateral movement.
MITRE ATT&CK:
6. Privilege Boundary Enumeration from Interactive Process Detected via Defend for Containers
File:
discovery_privilege_boundary_enumeration_from_interactive_process.tomlSeverity: Low | Risk Score: 21
Description:
Detects execution of privilege enumeration commands (
id,whoami,capsh,getcap,lsns) inside containers. Includes exclusions for common legitimate multi-process commands.Why it's relevant:
These commands are typically the first reconnaissance steps an attacker takes after gaining container access to understand their privilege level and potential escalation paths.
MITRE ATT&CK:
7. File Creation via Interactive Process Followed by Execution Detected via Defend for Containers
File:
execution_interactive_file_creation_followed_by_execution.tomlSeverity: Medium | Risk Score: 47
Description:
Detects when an interactive process creates a file followed by its execution within 3 seconds. Excludes legitimate package managers (
apt,yum,dnf, etc.).Why it's relevant:
This pattern indicates potential malware delivery or container breakout attempts where an attacker downloads a payload and immediately executes it.
MITRE ATT&CK:
8. File Creation via Interactive Process in System Binary Locations Detected via Defend for Containers
File:
execution_interactive_file_creation_in_system_binary_locations.tomlSeverity: Medium | Risk Score: 47
Description:
Detects file creation in sensitive system directories (
/etc,/root,/bin,/usr/bin,/usr/local/bin,/entrypoint) by download tools or processes running from suspicious locations.Why it's relevant:
Writing files to system binary locations can enable persistence, privilege escalation, or modification of container behavior. This is especially concerning when done by download tools or processes from temporary directories.
MITRE ATT&CK:
9. Suspicious Interactive Interpreter Command Execution Detected via Defend for Containers
File:
execution_suspicious_interactive_interpreter_command_execution.tomlSeverity: Medium | Risk Score: 47
Description:
Detects suspicious one-liner execution across multiple interpreters (Perl, PHP, Lua, Python, Ruby) with dangerous function calls including
exec,system,eval, network operations, and encoding/decoding functions.Why it's relevant:
Attackers frequently use scripting language one-liners for reverse shells, data exfiltration, or payload execution. This rule provides comprehensive coverage across the most commonly abused interpreters.
MITRE ATT&CK:
10. Suspicious Web Server Child Process Execution Detected via Defend for Containers
File:
persistence_suspicious_webserver_child_process_execution.tomlSeverity: Medium | Risk Score: 47
Description:
Detects shell execution spawned by web server processes or running as web server users (
apache,www-data,nginx, etc.). Covers a comprehensive list of web servers including Apache, Nginx, Gunicorn, uWSGI, and many others.Why it's relevant:
Web shells are a primary method for maintaining persistent access after web application exploitation. This rule detects the execution phase where an uploaded web shell spawns a command shell.
MITRE ATT&CK:
Updated Detection Rules
1. Credential Access - Service Account Token or Certificate Read
File:
credential_access_service_account_token_or_cert_read.tomlChanges:
logs-cloud_defend.process*to index patterns/run/secrets/path (in addition to/var/run/secrets/)cat,head,tail,more,lesscommands reading service account filesfileevent type toanyevent type to support both file and process eventsWhy:
Provides broader coverage for credential access attempts, catching both file-based access and command-line tools used to read sensitive Kubernetes credentials.
2. Discovery - Kubelet Certificate File Access
File:
discovery_kubelet_certificate_file_access.tomlChanges:
logs-cloud_defend.process*to index patternscat,head,tail,more,lesscommandsfileevent type toanyevent typeWhy:
Enhanced detection coverage to catch both direct file access and command-line reading of kubelet PKI certificates.
3. Discovery - Service Account Namespace Read
File:
discovery_service_account_namespace_read.tomlChanges:
logs-cloud_defend.process*to index patterns/run/secrets/pathfileevent type toanyevent typeWhy:
Improved detection of namespace discovery attempts which can reveal cluster topology information to attackers.
4. Execution - Tool Installation
File:
execution_tool_installation.tomlChanges:
bash,sh,dash,zsh,fish,tcsh,csh,kshWhy:
Installing shell interpreters via package managers is suspicious in production containers and could indicate an attacker preparing for interactive access.
Technical Notes
process.interactive == trueto focus on interactive (potentially attacker-controlled) sessionshost.os.type == "linux"andcontainer.id like "*"