Kubelet Pod Discovery Detected via Defend for Containers

This brief details detection of Kubelet pod discovery, typically performed by an attacker who has gained initial access to a Kubernetes container or node. The attack involves the repeated use of standard Linux utilities like ls, find, du, locate, and nice to query the /var/lib/kubelet/pods directory. This directory is the default location where Kubelet stores critical information about running pods, including their IDs, associated volumes, and other runtime artifacts. Attackers leverage this behavior to map the cluster's workload distribution, identify potential targets, and locate sensitive data such as mounted secrets, service account tokens, or kubeconfig files. This discovery phase is a crucial step in preparing for further compromise, such as credential harvesting, privilege escalation, or lateral movement within the Kubernetes environment or to the underlying host. The activity can originate from an interactive session via kubectl exec, SSH to the node, or a compromised container using container runtime attach.

Attack Chain

1. An attacker gains initial access to a Kubernetes container or node, potentially through a compromised application, exposed service, or misconfigured access.
2. From the compromised environment, the attacker executes a built-in Linux utility such as ls, find, du, locate, or nice.
3. The chosen utility is directed to enumerate or inspect the /var/lib/kubelet/pods directory, which contains details about active pods.
4. The attacker may use recursive commands like find /var/lib/kubelet/pods -maxdepth 2 to systematically explore pod subdirectories and their contents.
5. The attacker collects information on pod IDs, volume mounts, and other runtime artifacts to understand the cluster's architecture and running workloads.
6. Discovered information is correlated to identify sensitive areas, such as pods with privileged settings or specific application data.
7. The attacker searches for sensitive files like mounted secrets, service account tokens, or kubeconfig files within the enumerated pod directories.
8. This discovery phase prepares the attacker for subsequent actions, including credential harvesting, privilege escalation, or lateral movement within the Kubernetes cluster.

Impact

Successful Kubelet pod discovery can provide attackers with a detailed map of the Kubernetes cluster's running workloads and their configurations. This information is invaluable for identifying targets for privilege escalation, locating sensitive data, and planning lateral movement. If attackers gain access to /var/lib/kubelet via hostPath or privileged containers, they can read mounted secrets, service account tokens, and kubeconfig files, leading to credential harvesting. This can result in further compromise of the cluster, unauthorized access to cloud resources, data exfiltration, or complete control over the Kubernetes environment, potentially impacting numerous applications and services hosted within the cluster.

Recommendation

• Deploy the Sigma rule in this brief to your SIEM and tune for your environment, specifically for process_creation events involving the listed utilities and directory.
• Monitor process_creation and file_event logs for repeated access or execution attempts targeting the /var/lib/kubelet/pods directory, which is referenced in the detection rule.
• Restrict unnecessary hostPath mounts to /var/lib/kubelet and other critical node paths to prevent attackers from accessing sensitive host directories.
• Implement admission controls to block privileged or hostPID containers, and enforce non-root and read-only root filesystems for containers.
• Validate the actor's permissions and activity by correlating with Kubernetes API audit logs, particularly for users or service accounts involved in activity against /var/lib/kubelet/pods.