Elastic high stable kql

Kubernetes Pod Exec Cloud Instance Metadata Access

Detects Kubernetes pod exec sessions whose decoded command line references cloud instance metadata endpoints or equivalent hostnames and paths. Workloads that reach the link-local metadata IP, AWS IMDS paths, GCP computeMetadata, Azure IMDS token routes, or encoded variants are often attempting to harvest role credentials, tokens, or instance attributes from the underlying node or hypervisor boundary. That behavior is high risk in multi-tenant and regulated environments because it can expose short-lived cloud credentials to code running inside a container. The rule classifies a coarse cloud target label and whether the string looks like credential retrieval versus lighter reconnaissance.

View Source

Detection Logic

FROM logs-kubernetes.audit_logs-* metadata _id, _index, _version
| WHERE kubernetes.audit.objectRef.subresource == "exec"
  
AND kubernetes.audit.requestURI LIKE "*command=*"
| EVAL Esql.decoded_uri = URL_DECODE(kubernetes.audit.requestURI)
| GROK Esql.decoded_uri "%{DATA}/exec\\?%{DATA:raw_commands}&(?:container
| stdin
| stdout
| stderr)=%{GREEDYDATA}"
| EVAL command = REPLACE(raw_commands, "command=", "")
| EVAL command = REPLACE(command, "&", " ")
| EVAL Esql.executed_command = REPLACE(command, "\\+", " ")
| WHERE Esql.executed_command IS NOT NULL 
  
AND Esql.executed_command RLIKE """.*(169\.254\.169\.254
| 2852039166
| 0xa9fea9fe
| /latest/api/token
| /latest/meta-data
| /latest/user-data
| /latest/dynamic/instance-identity
| computeMetadata/v1
| metadata\.google\.internal
| metadata/identity/oauth2/token
| metadata/instance).*"""
| EVAL Esql.cloud_target = CASE(
    Esql.executed_command RLIKE """.*(169\.254\.169\.254
| 2852039166
| 0xa9fea9fe
| /latest/meta-data
| /latest/api/token
| /latest/user-data
| /latest/dynamic).*""", "AWS_IMDS",
    Esql.executed_command RLIKE """.*(computeMetadata/v1
| metadata\.google\.internal).*""", "GCP_METADATA",
    Esql.executed_command RLIKE """.*metadata/identity/oauth2/token.*""", "AZURE_IMDS",
    "UNKNOWN"
  )
| EVAL Esql.is_credential_theft = CASE(
    Esql.executed_command RLIKE """.*(security-credentials
| /api/token
| oauth2/token
| service-accounts/.*/token).*""", "yes",
    "recon"
  )
| KEEP Esql.*, user.name, user_agent.original, event.*, source.ip, kubernetes.audit.*, _id, _version, _index, data_stream.namespace

Field Validations

Loading…

Comments (0)

Loading comments...