Container Environment: Suspicious Fileless Payload Execution via Shell Piping

This alert identifies potentially malicious fileless execution in Linux containers. Attackers often leverage the pattern of piping network-downloaded content directly into a shell (e.g., curl <url> | sh) to achieve code execution without writing artifacts to the container filesystem. This technique is primarily used during initial foothold or lateral movement to evade forensic analysis and disk-based security controls.

Attack Chain

1. Initial access or lateral movement phase within a container.
2. Execution of a downloader utility (curl or wget).
3. Fetching of an external payload from a remote malicious server.
4. Piping of the remote payload output directly into a local shell or script interpreter (e.g., bash, sh, python, or perl).
5. Execution of the code in memory, bypassing persistent file scanning.
6. Potential follow-on activities, such as reverse shell spawning, crypto-miner installation, or container runtime socket access.

Recommendation

• Implement runtime monitoring to detect the chaining of downloader processes (curl/wget) and scripting interpreters.
• Restrict interactive container access (exec sessions) via RBAC and just-in-time privilege requests.
• Apply egress network policies to limit container communication to known-good internal or external endpoints.
• Harden container images to remove unnecessary utilities like curl and wget where possible.
• Review and deploy the provided Elastic Defend for Containers rule logic to monitor for ephemeral pipe execution patterns.