Techniques
Sample rules
Container Runtime CLI Execution with Suspicious Arguments
- source: elastic
- technicques:
- T1609
- T1611
Description
Detects execution of container runtime CLI tools (ctr, crictl, nerdctl) with arguments indicating container creation, command execution inside existing containers, image manipulation, or host filesystem mounting. These tools interact directly with the container runtime socket, bypassing the Kubernetes API server, RBAC authorization, admission webhooks, pod security standards, and Kubernetes audit logging entirely. Attackers with host-level access may use these tools to create privileged ghost containers, exec into other pods to steal service account tokens and secrets, pull attacker-controlled images, and destroy evidence, all while remaining invisible to Kubernetes-level monitoring.
Detection logic
process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "executed") and
(
(
process.name in ("ctr", "crictl", "nerdctl") and
(
(process.args == "tasks" and process.args == "exec") or
(process.args == "run" and process.args in ("--privileged", "--rm", "--mount", "--net-host", "--pid-host")) or
(process.args == "snapshots" and process.args == "mount")
)
) or
(
(process.executable like ("/dev/shm/*", "/tmp/*", "/var/tmp/*") or process.name : ".*") and
process.args like ("*containerd.sock*", "k8s.io")
)
) and
not process.parent.executable in (
"/usr/bin/kubelet", "/usr/local/bin/kubelet",
"/usr/bin/containerd", "/usr/sbin/containerd",
"/lib/systemd/systemd", "/usr/lib/systemd/systemd", "/sbin/init"
)
Suspicious Container Runtime CLI Execution
- source: elastic
- technicques:
- T1609
- T1611
Description
Detects execution of container runtime CLI tools (ctr, crictl, nerdctl) with arguments indicating container creation, command execution inside existing containers, image manipulation, or host filesystem mounting. These tools interact directly with the container runtime socket, bypassing the Kubernetes API server, RBAC authorization, admission webhooks, pod security standards, and Kubernetes audit logging entirely. Attackers with host-level access may use these tools to create privileged ghost containers, exec into other pods to steal service account tokens and secrets, pull attacker-controlled images, and destroy evidence, all while remaining invisible to Kubernetes-level monitoring.
Detection logic
process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
(
(
process.name in ("ctr", "crictl", "nerdctl") and
(
(process.args == "tasks" and process.args == "exec") or
(process.args == "run" and process.args in ("--privileged", "--rm", "--mount", "--net-host", "--pid-host")) or
(process.args == "snapshots" and process.args == "mount")
)
) or
(
(process.executable like ("/dev/shm/*", "/tmp/*", "/var/tmp/*") or process.name : ".*") and
process.args like ("*containerd.sock*", "*k8s.io*")
)
) and
not process.parent.executable in (
"/usr/bin/kubelet", "/usr/local/bin/kubelet",
"/usr/bin/containerd", "/usr/sbin/containerd",
"/lib/systemd/systemd", "/usr/lib/systemd/systemd", "/sbin/init"
)