Elastic medium stable eql

Potential Kubeletctl Execution

Detects the execution of kubeletctl on Linux hosts. Kubeletctl is a command-line tool that can be used to interact with the Kubelet API directly, simplifying access to Kubelet endpoints that can be used for discovery and, in some cases, lateral movement within Kubernetes environments.

View Source

Detection Logic

process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "executed") and 
(
  process.name == "kubeletctl" or
  (process.args in ("run", "exec", "scan", "pods", "runningpods", "attach", "portForward", "cri", "pid2pod") and process.args:("*:10250*", "*:10255*"))
)

False Positives

⚠ Administrators or developers may execute kubeletctl during legitimate troubleshooting or incident response to validate Kubelet API connectivity or enumerate pods. Confirm the user/session and change window before escalating.

Field Validations

Loading…

Comments (0)

Loading comments...