Briefs

An Elastic Defend for Containers rule detects when an interactive shell is spawned inside a running Linux container, indicating a potential container breakout attempt or an attacker's unauthorized access to the underlying host through the execution of shells such as bash, sh, or zsh with interactive flags.

Adversaries leverage tools like wget, curl, or busybox to create files within critical system binary directories such as /etc, /root, /bin, /usr/bin, /usr/local/bin, or /entrypoint inside running Linux containers to establish persistence, execute commands, or evade detection.

An Elastic Defend for Containers rule detects suspicious activity in Linux containers where a process creates a file in a writable directory and immediately executes it, indicating potential hands-on intrusion, container breakout, unauthorized host access, privilege escalation, or evasion of security controls.

This detection rule targets the execution of interactive shell sessions within Linux containers, often initiated by an attacker using commands like `kubectl exec`, to identify potential compromise attempts or unauthorized access leading to container breakout or further environmental compromise.

Adversaries leveraging initial access within a container may execute direct Kubernetes API requests using tools like curl, wget, or kubectl, often with bearer tokens and insecure TLS, for cluster enumeration, lateral movement, or privilege escalation, which can be detected by Elastic Defend for Containers.

Elastic Defend for Containers detects the enumeration of installed tools within a Linux container using the `which` command, a common adversary technique (T1518, T1613) for post-compromise discovery and living-off-the-land actions, enabling subsequent payload download, cluster manipulation, or reconnaissance without deploying new binaries.

Adversaries gaining initial access to a Kubernetes pod often read the service account namespace file, located at `/var/run/secrets/kubernetes.io/serviceaccount/namespace` or `/run/secrets/kubernetes.io/serviceaccount/namespace`, to identify the container's namespace and understand its context, enabling further discovery and lateral movement within the Kubernetes environment.

This brief details the detection of commands such as 'id', 'whoami', 'capsh', 'getcap', and 'lsns' executed within Linux containers by adversaries seeking to enumerate privilege boundaries, user context, and Linux capabilities for privilege escalation or host escape, as detected by Elastic Defend for Containers.

Elastic's Defend for Containers detects adversaries utilizing the `jq` command within Linux containers to enumerate cluster and service information, posing a reconnaissance threat to the containerized environment.

This rule detects the use of common Linux utilities such as du, nice, find, locate, and ls to repeatedly enumerate the /var/lib/kubelet/pods directory on a Kubernetes cluster, indicating an attacker attempting to discover running pods, their IDs, volumes, and runtime artifacts from a compromised container or node.

Adversaries execute 'env' or 'printenv' commands within compromised Linux containers to enumerate environment variables, aiming to discover and harvest sensitive data such as cloud API keys, Kubernetes service account tokens, or database credentials, which facilitates lateral movement and data exfiltration within cloud environments.

Adversaries leverage DNS enumeration tools such as nslookup, dig, host, or getent hosts inside compromised Linux containers to discover internal Kubernetes services and network configuration, facilitating lateral movement and further exploitation.

Attackers are leveraging encoded payloads within Linux containers for defense evasion, using common decoding tools like base64, xxd, or scripting language one-liners to deobfuscate and execute malicious code, allowing for covert command and control, staging, and further compromise.

Adversaries modify the dynamic linker preload shared object (`/etc/ld.so.preload`) or configuration files (`/etc/ld.so.conf.d/*`, `/etc/ld.so.conf`) inside Linux containers to hijack the dynamic linker, forcing the system to load malicious libraries at runtime, thereby gaining unauthorized access, maintaining persistence, escalating privileges, and evading detection of malicious processes.

Adversaries exploit containerized environments by executing malicious code or interactive shells from transient, low-trust directories like /tmp or /dev/shm, or using executables with hidden names, to evade detection, establish persistence, and facilitate data exfiltration.

An unidentified adversary is leveraging common shell commands to delete or disable command-line history files within Linux containers, aiming to evade detection by obscuring their activities during reconnaissance or credential access.

A detection rule from Elastic identifies adversaries reading Kubernetes service account tokens or CA certificates within containers, typically using utilities like `cat` on `/var/run/secrets/kubernetes.io/serviceaccount/token` and `ca.crt` to authenticate to the Kubernetes API server and escalate privileges or expand access within the cluster.

Adversaries may search for sensitive credentials, such as SSH keys and passwords, within Linux containers using utilities like grep and find, potentially leading to unauthorized access or container escape.

An attacker using system search utilities like `grep` or `find` within a containerized environment to locate cloud credentials (AWS, Azure, GCP) indicates an attempt to gain unauthorized access to sensitive cloud resources or perform a container breakout to compromise the underlying cloud infrastructure.

This threat brief details how adversaries download files from the internet into Linux containers using `curl` or `wget` to stage tools, payloads, or establish application-layer command and control (C2), which detection engineers can identify by monitoring process execution within containers and correlating with audit logs.

Attackers utilize the `curl` command-line tool with SOCKS proxy options inside Linux containers to bypass network restrictions, enabling command and control communications or data exfiltration, which defenders can detect by monitoring process execution within container environments for suspicious `curl` arguments and network tunneling activity.

A critical arbitrary file upload vulnerability (CVE-2026-14270) in the Extra Checkout Options plugin for WordPress, affecting versions up to and including 2.3.2, allows low-privileged authenticated users to modify upload allowlists and upload malicious PHP files via an AJAX action, ultimately achieving remote code execution on the server.

A vulnerability in Apache Tomcat allows a remote, anonymous attacker to perform a Denial of Service attack, potentially disrupting service availability for applications hosted on the affected server.

An attacker can exploit multiple vulnerabilities in BlackBerry UEM Management Console to perform cross-site scripting attacks, cause a denial of service, and disclose information.

Multiple unspecified vulnerabilities in the Xen hypervisor allow an attacker to escalate privileges, disclose confidential information, or cause a denial-of-service condition affecting virtualized environments.

Multiple vulnerabilities exist in IBM WebSphere Application Server and IBM WebSphere Application Server Liberty that an attacker can exploit to execute arbitrary code, escalate privileges, perform denial of service attacks, disclose sensitive information, manipulate files, conduct cross-site scripting attacks, and bypass security measures.

Multiple vulnerabilities in Apache Traffic Server can be exploited by a remote, anonymous attacker to bypass security measures, disclose or manipulate data, trigger a denial-of-service, and potentially achieve code execution.

Multiple vulnerabilities in Broadcom Brocade SANnav can be exploited by an attacker from an adjacent network to achieve information disclosure, execute SQL injection attacks, and manipulate data within the system.

An out-of-bounds write vulnerability, CVE-2026-18220, exists in the BFD library's DLX ELF backend (bfd/elf32-dlx.c) in GNU binutils, allowing attackers to achieve arbitrary code execution via a specially crafted ELF/DLX object file processed by BFD-consuming tools.

An unauthenticated attacker can exploit a Stored Cross-Site Scripting vulnerability (CVE-2026-16655) in the Fluent Forms WordPress plugin, versions up to and including 6.2.7, via insufficient input sanitization of the Name Field Nested `password` Member, allowing injection of arbitrary web scripts that execute in a user's browser upon page access.