Potential Cluster Enumeration via jq Detected in Containers

This brief details the detection of the jq command being executed within Linux containers, a behavior often leveraged by adversaries for reconnaissance. The jq utility, a lightweight and flexible command-line JSON processor, is commonly employed by attackers to parse and extract valuable information about the cluster environment, including services and configurations, into a more readable format or to set environment variables. While jq has legitimate uses for debugging or troubleshooting, its execution inside a container for cluster enumeration is uncommon and can indicate malicious activity, as identified by Elastic's Defend for Containers. The detection rule is part of Elastic's broader security offerings, introduced with their 9.3.0 stack version. This activity signals an attacker's attempt to understand the environment for potential lateral movement, privilege escalation, or data exfiltration.

Impact

Successful cluster enumeration by an adversary provides critical intelligence about the containerized environment. This information can include details about running services, network configurations, exposed APIs, and resource allocations. Such reconnaissance enables attackers to identify misconfigurations, vulnerable services, or sensitive data within the cluster, which can then be exploited for further attacks, including privilege escalation, lateral movement to other containers or nodes, and ultimately, data exfiltration or denial of service. While this specific action is a discovery technique, it lays the groundwork for more severe compromise within cloud-native infrastructures.

Recommendation

• Deploy the Sigma rule provided in this brief to your SIEM and tune for your environment, focusing on Linux process_creation logs.
• Investigate all alerts generated by the "Detect Potential Cluster Enumeration using jq in Containers" rule to distinguish between legitimate debugging/troubleshooting activity and malicious reconnaissance.
• Ensure Elastic Defend for Containers integration is properly configured and enabled to capture necessary process_creation logs, especially for containerized environments.
• Review container base images and applications for any legitimate uses of jq that might cause false positives, and consider baselining expected jq usage patterns.