Query: detect Detects the creation of a "privileged" container, an action which could be indicative of a threat actor mounting a conta in logs
Matching passage: Sigma rule: Detects the creation of a "privileged" container, an action which could be indicative of a threat actor mounting a conta. Logsource: kubernetes / application / audit. Rule: title: Privileged Container Deployed id: c5cd1b20-36bb-488d-8c05-486be3d0cb97 status: test description: 'Detects the creation of a "privileged" container, an action which could be indicative of a threat actor mounting a container breakout attacks. A privileged container is a container that can access the host with all of the root capabilities of the host machine. This allows it to view, interact and modify processes, network operations, IPC calls, the file system, mount points, SELinux configurations etc. as the root user on the host. Various versions of "privileged" containers can be specified, e.g. by setting the securityContext.privileged flag in the resource specification, setting non-standard Linux capabilities, or configuring the hostNetwork/hostPID fields ' references: - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Privileged%20container/ - https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-kubernetes.html#privilegeescalation-kubernetes-privilegedcontainer - https://www.elastic.co/guide/en/security/current/kubernetes-pod-created-with-hostnetwork.html - https://www.elastic.co/guide/en/security/current/kubernetes-container-created-with-excessive-linux-capabilities.html author: Leo Tsaousis (@laripping) date: 2024-03-26 tags: - attack.t1611 - attack.privilege-escalation logsource: category: application product: kubernetes service: audit detection: selection: verb: create objectRef.resource: pods capabilities: '*' condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects the presence of the "u202+E" character, which causes a terminal, browser, or operating system to render text in. Logsource: windows / process_creation. Rule: title: Potential Defense Evasion Via Right-to-Left Override id: ad691d92-15f2-4181-9aa4-723c74f9ddc3 related: - id: e0552b19-5a83-4222-b141-b36184bb8d79 type: derived - id: 584bca0f-3608-4402-80fd-4075ff6072e3 type: derived status: test description: 'Detects the presence of the "u202+E" character, which causes a terminal, browser, or operating system to render text in a right-to-left sequence. This character is used as an obfuscation and masquerading techniques by adversaries to trick users into opening malicious files. ' references: - https://redcanary.com/blog/right-to-left-override/ - https://www.malwarebytes.com/blog/news/2014/01/the-rtlo-method - https://unicode-explorer.com/c/202E - https://tria.ge/241015-l98snsyeje/behavioral2 - https://unprotect.it/technique/right-to-left-override-rlo-extension-spoofing/ author: Micah Babinski, @micahbabinski, Swachchhanda Shrawan Poudel (Nextron Systems), Luc Génaux date: 2023-02-15 modified: 2026-03-20 tags: - attack.stealth - attack.t1036.002 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - \u202e - '[U+202E]' - ‮ condition: selection falsepositives: - Commandlines that contains scriptures such as arabic or hebrew might make use of this character level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_susp_right_to_left_override/info.yml