Query: alert when Detects the creation of a "privileged" container, an action which could be indicative of a threat actor mounting a conta
Matching passage: Sigma rule: Detects the creation of a "privileged" container, an action which could be indicative of a threat actor mounting a conta. Logsource: kubernetes / application / audit. Rule: title: Privileged Container Deployed id: c5cd1b20-36bb-488d-8c05-486be3d0cb97 status: test description: 'Detects the creation of a "privileged" container, an action which could be indicative of a threat actor mounting a container breakout attacks. A privileged container is a container that can access the host with all of the root capabilities of the host machine. This allows it to view, interact and modify processes, network operations, IPC calls, the file system, mount points, SELinux configurations etc. as the root user on the host. Various versions of "privileged" containers can be specified, e.g. by setting the securityContext.privileged flag in the resource specification, setting non-standard Linux capabilities, or configuring the hostNetwork/hostPID fields ' references: - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Privileged%20container/ - https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-kubernetes.html#privilegeescalation-kubernetes-privilegedcontainer - https://www.elastic.co/guide/en/security/current/kubernetes-pod-created-with-hostnetwork.html - https://www.elastic.co/guide/en/security/current/kubernetes-container-created-with-excessive-linux-capabilities.html author: Leo Tsaousis (@laripping) date: 2024-03-26 tags: - attack.t1611 - attack.privilege-escalation logsource: category: application product: kubernetes service: audit detection: selection: verb: create objectRef.resource: pods capabilities: '*' condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects Schtask creations that point to a suspicious folder or an environment variable often used by malware. Logsource: windows / process_creation. Rule: title: Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE id: 81325ce1-be01-4250-944f-b4789644556f related: - id: 43f487f0-755f-4c2a-bce7-d6d2eec2fcf8 type: derived status: test description: Detects Schtask creations that point to a suspicious folder or an environment variable often used by malware references: - https://www.welivesecurity.com/2022/01/18/donot-go-do-not-respawn/ - https://www.joesandbox.com/analysis/514608/0/html#324415FF7D8324231381BAD48A052F85DF04 - https://blog.talosintelligence.com/gophish-powerrat-dcrat/ author: Florian Roth (Nextron Systems) date: 2022-02-21 modified: 2025-10-07 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.t1053.005 logsource: product: windows category: process_creation detection: selection_1_create: Image|endswith: \schtasks.exe CommandLine|contains|windash: ' /create ' selection_1_all_folders: CommandLine|contains: - :\Perflogs - :\Users\All Users\ - :\Users\Default\ - :\Users\Public - :\Windows\Temp - \AppData\Local\ - \AppData\Roaming\ - '%AppData%' - '%Public%' selection_2_parent: ParentCommandLine|endswith: \svchost.exe -k netsvcs -p -s Schedule selection_2_some_folders: CommandLine|contains: - :\Perflogs - :\Windows\Temp - \Users\Public - '%Public%' filter_optional_other: - ParentCommandLine|contains: unattended.ini - CommandLine|contains: update_task.xml filter_optional_team_viewer: CommandLine|contains: /Create /TN TVInstallRestore /TR filter_optional_avira_install: CommandLine|contains|all: - '/Create /Xml ' - \Temp\.CR. - \Avira_Security_Installation.xml filter_optional_avira_other: CommandLine|contains|all: - /Create /F /TN - '/Xml ' - \Temp\ - Avira_ CommandLine|contains: - .tmp\UpdateFallbackTask.xml - .tmp\WatchdogServiceControlManagerTimeout.xml - .tmp\SystrayAutostart.xml - .tmp\MaintenanceTask.xml filter_optional_klite_codec: CommandLine|contains|all: - \Temp\ - '/Create /TN "klcp_update" /XML ' - \klcp_update_task.xml condition: ( all of selection_1_* or all of selection_2_* ) and not 1 of filter_optional_* falsepositives: - Benign scheduled tasks creations or executions that happen often during software installations - Software that uses the AppData folder and scheduled tasks to update the software in the AppData folders level: medium