Elastic high stable kql

Kubernetes Pod Exec with Curl or Wget to HTTPS

Detects pod or attach exec API calls where the decoded request query implies curl or wget fetching an https URL. Attackers with permission to exec into workloads often run one-liners to stage tooling, pull scripts or binaries, or exfiltrate data over HTTPS—activity that should be rare compared to shells, debuggers, or expected health checks. The rule decodes the audit requestURI, reconstructs a readable command string from repeated command parameters, and applies noise filters for common cluster health and OIDC/JWKS endpoints so benign automation is less likely to alert.

View Source

Detection Logic

FROM logs-kubernetes.audit_logs-* metadata _id, _index, _version
| WHERE kubernetes.audit.objectRef.subresource == "exec"
  
AND kubernetes.audit.requestURI LIKE "*command=*"
| EVAL Esql.decoded_uri = URL_DECODE(kubernetes.audit.requestURI)
| GROK Esql.decoded_uri "%{DATA}/exec\\?%{DATA:raw_commands}&(?:container
| stdin
| stdout
| stderr)=%{GREEDYDATA}"
| EVAL command = REPLACE(raw_commands, "command=", "")
| EVAL command = REPLACE(command, "&", " ")
| EVAL Esql.executed_command = REPLACE(command, "\\+", " ")
| WHERE Esql.executed_command IS NOT NULL 
  
AND Esql.executed_command RLIKE """.*(curl.*https
| wget.*https).*"""
  
AND NOT Esql.executed_command RLIKE """.*(/api/v1/health
| /healthz
| /readyz
| /livez
| 127\.0\.0\.1
| localhost
| /openid/v1/jwks
| /openid-connect/certs
| /.well-known/openid-configuration
| /.well-known/jwks\.json
| kubernetes\.default\.svc).*"""
| KEEP Esql.*, user.name, user_agent.original, event.*, source.ip, kubernetes.audit.*, _id, _version, _index, data_stream.namespace

Field Validations

Loading…

Comments (0)

Loading comments...