Attack Chain

1. Initial Access to Cluster: An attacker gains unauthorized access to a Kubernetes cluster or container orchestration environment through compromised credentials, exposed APIs, or misconfigurations.
2. Container Enumeration: The attacker enumerates running pods and containers within the cluster to identify suitable targets for interactive access.
3. Interactive Shell Execution: The attacker uses kubectl exec -i -t [pod_name] -- [shell_command] (e.g., bash, sh) to establish an interactive shell session directly inside a targeted container.
4. Container Reconnaissance: Within the interactive shell, the attacker executes commands (e.g., ls, pwd, env, cat /etc/passwd) to understand the container's environment, configuration, and mounted volumes.
5. Malicious Tool Deployment/Execution: The attacker downloads or executes additional malicious scripts or binaries within the container to further compromise it, search for sensitive data, or establish persistence.
6. Container Breakout Attempt: The attacker exploits misconfigurations or vulnerabilities (e.g., insecure mounts, privileged containers) to escape the container's isolation and gain access to the underlying host or other containers.
7. Lateral Movement/Impact: Successful breakout allows the attacker to move laterally across the infrastructure, elevate privileges, exfiltrate sensitive data, or deploy further malware like ransomware.

Impact

Successful exploitation of unauthorized interactive shell access to a container can lead to severe consequences, ranging from the immediate compromise of the container itself to broader system-wide impact. Attackers can exfiltrate sensitive data stored within the container or accessible via its mounted volumes. They can also establish persistence mechanisms, pivot to other containers, or achieve a container breakout, gaining control over the underlying host. This could affect the integrity and confidentiality of applications and data, disrupt services, or lead to unauthorized resource utilization (e.g., for cryptocurrency mining). The direct impact can involve intellectual property theft, customer data exposure, or complete system takeover, with potential financial, reputational, and regulatory repercussions.

Recommendation

• Deploy the Sigma rule "Interactive Shell in Container Detected" to your SIEM system to detect exec events of common shells within your Linux container environments.
• Review process_creation logs for suspicious shell executions; investigate the container.id, process.entry_leader.same_as_process (if available in your logs), and associated user activities to differentiate legitimate administrative tasks from malicious activity.
• Implement strict Role-Based Access Control (RBAC) in Kubernetes and other container orchestration platforms to limit who can use kubectl exec and under what conditions.
• Configure exceptions for known legitimate administrative or debugging sessions, as outlined in the falsepositives section of the Sigma rule, to reduce alert fatigue.
• Audit and monitor all kubectl exec commands and interactive shell sessions within containers, correlating them with user activity logs to identify the responsible user or service account.