Elastic medium stable eql

Potential Kubectl Masquerading via Unexpected Process

This rule detects potential kubectl masquerading activity by monitoring for process events where the process name is not "kubectl" but the command line arguments include kubectl-related commands. This could indicate an adversary attempting to masquerade as legitimate kubectl activity to evade detection. This rule covers evasion gaps introduced by renaming the kubectl binary, or placing it in an unusual directory.

View Source

Detection Logic

process where host.os.type in ("linux", "macos") and event.type == "start" and
event.action in ("exec", "exec_event", "start", "executed", "process_started") and
(
  process.executable like~ (
    "/tmp/*", "/private/tmp/*", "/var/tmp/*", "/private/var/tmp/*", "/dev/shm/*", "/root/*", "/var/www/*", "/home/*", "/Users/*", "./kubectl"
  ) or
  process.name like ".*"
) and
process.args like~ (

  // get and describe commands
  "*get po*", "*get deploy*", "*get node*", "*get svc*", "*get service*", "*get secret*", "*get clusterrole*", "*get ingress*",
  "*get configmap*", "*describe po*", "*describe deploy*", "*describe node*", "*describe svc*", "*describe service*",
  "*describe secret*", "*describe configmap*", "*describe clusterrole*", "*describe ingress*",
  
  // exec commands
  "*exec -it*", "*exec --stdin*", "*exec --tty*",
  
  // networking commands
  "*port-forward* ", "*proxy --port*", "*run --image=*", "*expose*",

  // authentication/impersonation commands
  "*auth can-i*", "*--kubeconfig*", "*--as *", "*--as=*", "*--as-group*", "*--as-uid*"
) and not (
  process.executable like "/tmp/newroot/*" or
  process.name == ".flatpak-wrapped"
)

Field Validations

Loading…

Comments (0)

Loading comments...