Kubernetes

This detection rule targets the execution of interactive shell sessions within Linux containers, often initiated by an attacker using commands like `kubectl exec`, to identify potential compromise attempts or unauthorized access leading to container breakout or further environmental compromise.

Adversaries leveraging initial access within a container may execute direct Kubernetes API requests using tools like curl, wget, or kubectl, often with bearer tokens and insecure TLS, for cluster enumeration, lateral movement, or privilege escalation, which can be detected by Elastic Defend for Containers.

Adversaries execute 'env' or 'printenv' commands within compromised Linux containers to enumerate environment variables, aiming to discover and harvest sensitive data such as cloud API keys, Kubernetes service account tokens, or database credentials, which facilitates lateral movement and data exfiltration within cloud environments.

This threat brief details how adversaries download files from the internet into Linux containers using `curl` or `wget` to stage tools, payloads, or establish application-layer command and control (C2), which detection engineers can identify by monitoring process execution within containers and correlating with audit logs.

This content introduces AI Detection and Response (AIDR) as a new cybersecurity category to address emerging threats from autonomous AI agents, including supply chain attacks and unintended data sharing, highlighting their ability to execute with inherited privileges across endpoints, SaaS, and cloud environments.

CrowdStrike's AI security research team has identified 18 new prompt injection techniques, expanding its taxonomy to over 200 methods, which enable adversaries to manipulate AI systems and agents through indirect means like hidden context, delayed triggers, and special token injection, leading to unauthorized actions such as data exfiltration or arbitrary command execution.

Roundup of Google security advisories published in July 2026.

Roundup of Microsoft security advisories published in July 2026.

This rule detects Linux process executions that reference /etc/kubernetes/manifests in process arguments, which may indicate tampering with static pod manifests for persistence or privilege escalation in Kubernetes environments.

This rule detects Linux process executions that access high-value Kubernetes service-account material, kubeconfig or node PKI paths, or common cloud files, potentially indicating credential theft within in-cluster and hybrid environments.

Detection of non-system identities using the Kubernetes nodes/proxy API to proxy requests through the API server directly to a node's Kubelet, potentially leading to privilege escalation and sensitive information exposure.

Detects creation or approval of a Kubernetes CertificateSigningRequest (CSR) by a non-system identity, indicating an attacker attempting to obtain a long-lived client certificate for persistent cluster access with elevated privileges.

A path traversal vulnerability in Helm versions 4.0.0 to 4.1.3 allows a malicious plugin to write files to arbitrary locations on the filesystem, leading to potential system compromise.

An adversary modifies Kubernetes admission controller configurations to achieve persistence, escalate privileges, or gain unauthorized access to credentials within the cluster.

This rule detects unusual request responses in Kubernetes audit logs by monitoring for anomalies in username and response annotations, potentially identifying unauthorized access or misconfigurations.

The rule detects when a service account or node attempts to enumerate its permissions using selfsubjectaccessreview/rulesreview APIs with an unusual user agent, potentially indicating credential compromise and reconnaissance in a Kubernetes cluster.

Attackers attempt to enumerate and discover sensitive information within a Kubernetes cluster by leveraging common shells, utilities, and specialized tools, as reflected in audit logs.

A Kubernetes service account made an unauthorized request to the API server using an unusual user agent, potentially indicating compromised credentials used for resource discovery or lateral movement.

Detection of interactive access to a Kubernetes service account token or certificate followed by a Kubernetes API request, potentially indicating credential theft and lateral movement within the cluster.

An anonymous user attempts to enumerate Kubernetes API endpoints, resulting in a series of failed API requests across multiple endpoints, potentially revealing the cluster's exposed surface.

Detection of local file inclusion (LFI) attacks targeting Kubernetes Nginx ingress controllers through analysis of Kubernetes logs.

The use of `kubectl get secrets --all-namespaces` command is detected, which enumerates secret resources across the entire Kubernetes cluster, potentially aiding credential discovery, privilege escalation, or lateral movement.

The rule detects network connection attempts to the Kubernetes Kubelet API ports 10250 and 10255 on internal IP ranges from Linux hosts, indicating potential lateral movement within container and cluster environments.

Adversaries may perform reconnaissance in a Kubernetes environment by rapidly querying multiple resource types to map the environment and identify potential privilege escalation paths.

An unusual process connecting to a container runtime Unix socket like Docker or Containerd can indicate an attacker attempting to bypass Kubernetes security measures for container manipulation.

A single source IP accessing secret-management APIs across multiple cloud providers (AWS, GCP, Azure) and Kubernetes clusters within a short timeframe indicates credential theft or token replay for secret harvesting.

This analytic detects unauthorized access attempts to Kubernetes by analyzing Kubernetes audit logs, identifying anomalies in access patterns based on request source and response statuses, potentially leading to unauthorized control over Kubernetes resources.

This analytic detects suspicious image pulling in Kubernetes environments by monitoring Kubernetes audit logs for image pull requests that do not match a predefined list of allowed images, potentially indicating malicious software deployment or system infiltration.

This analytic detects when a shell is spawned within a Kubernetes container using Falco, potentially indicating unauthorized access, command execution, process manipulation, or privilege escalation, which can lead to data breaches and service disruptions.

An unusual username is accessing Kubernetes secrets, potentially leading to unauthorized access and data exfiltration.

This rule flags potential reverse shell activity via kubectl exec commands in Kubernetes pods by detecting specific shell and socket idioms within URL-decoded command payloads in Kubernetes audit logs, indicating post-exploitation interactive access and command-and-control.

Detection of Kubernetes pod creation in default, kube-system, or kube-public namespaces using audit logs, potentially indicating attacker attempts to hide or evade defenses following a cluster breach.

Detection of a Kubernetes NodePort service creation, potentially exposing internal services to the external network, monitored via Kubernetes Audit logs, and indicating a threat to the Kubernetes infrastructure's integrity and security.

This analytic detects remote file inclusion (RFI) attacks targeting Kubernetes Nginx ingress controllers by analyzing Kubernetes logs from the Nginx ingress controller and identifying suspicious URL requests, potentially leading to arbitrary code execution or sensitive data access.

Detection of forbidden requests originating from unusual user agents within a Kubernetes environment, potentially indicating adversary attempts to exploit vulnerabilities or evade detection by using non-standard user agents to interact with the Kubernetes API.

The creation of a Kubernetes DaemonSet is detected via Kubernetes Audit logs, indicating a potential attempt to maintain persistent access and control within the cluster by ensuring a specific pod runs on every node.

The creation of Kubernetes cron jobs is detected by monitoring Kubernetes Audit logs, a technique that could enable attackers to execute scheduled malicious tasks, potentially leading to persistent attacks, service disruptions, or unauthorized access to sensitive information.

This rule detects forbidden direct interactive Kubernetes API requests by correlating interactive command execution inside a container with explicitly forbidden Kubernetes API requests, indicating potential enumeration and privilege testing for lateral movement.

Detects potential scanning activities within a Kubernetes environment by identifying multiple unauthorized access attempts (HTTP 403 responses) from unauthenticated IP addresses in Kubernetes audit logs, potentially indicating vulnerability probing or exploitation attempts.

This rule detects interactive commands executed inside containers using atypical utilities to interact with the Kubernetes API, paired with near-simultaneous API activity on sensitive resources, potentially indicating lateral movement and discovery by an attacker from within a container.

Detection of Kubernetes pods configured to use the host network namespace via audit logs, potentially allowing attackers to monitor all node network traffic for sensitive data and privilege escalation.

This rule detects when an unauthenticated user request is authorized within a Kubernetes cluster via an unusual user agent, potentially indicating an attacker attempting to gain initial access or avoid attribution by exploiting anonymous accounts.

This analytic detects potential reconnaissance activities within a Kubernetes environment by identifying repeated failed access attempts or unusual API requests from unauthenticated users based on Kubernetes audit logs, indicating a potential attacker's preliminary reconnaissance.

Detection of Kubernetes privileged pods creation or update, which indicates an attempt to escalate privileges and gain full access to the host's namespace and devices, potentially leading to unauthorized access, data breaches, and service disruptions.