Kubernetes Container Reverse Shell Execution

Query

// K8S-11  Reverse Shell Pattern (Container und Node)
CloudProcessEvents
| where Timestamp > ago(1h)
| where ProcessCommandLine contains "/dev/tcp/" or ProcessCommandLine contains "/dev/udp/"
     or (ProcessName in~ ("nc", "ncat", "netcat", "busybox") and ProcessCommandLine has_any (" -e ", " -c ", "/bin/sh", "/bin/bash"))
     or (ProcessName =~ "socat" and ProcessCommandLine has_any ("exec:", "EXEC:", "pty", "system:"))
     or (ProcessName startswith "python" and ProcessCommandLine has "socket" and ProcessCommandLine has_any ("pty.spawn", "subprocess", "dup2"))
     or (ProcessName =~ "perl" and ProcessCommandLine has "socket" and ProcessCommandLine has "exec")
| project Timestamp, ReportId, AzureResourceId, KubernetesNamespace, KubernetesPodName, ContainerName,
          ContainerImageName, AccountName, ParentProcessName, ProcessName, ProcessCommandLine

About this query

Kubernetes Container Reverse Shell Execution*

Query Information

MITRE ATT&CK Technique(s)

Technique ID	Title	Link
T1059.004	Unix Shell	https://attack.mitre.org/techniques/T1059/004
T1059.006	Python	https://attack.mitre.org/techniques/T1059/006

Description

Detects common reverse shell patterns within containerized environments by monitoring process execution commands. The rule identifies the use of network device files (/dev/tcp, /dev/udp) or common networking utilities (netcat, socat, python, perl) with flags commonly used to redirect input/output streams to a remote network socket.

Author <Optional>

Name: Benjamin Zulliger
Github: https://github.com/benscha/KQLAdvancedHunting
LinkedIn: https://www.linkedin.com/in/benjamin-zulliger/

Defender XDR

Explanation

This KQL (Kusto Query Language) query is designed to detect potential reverse shell activities within Kubernetes container environments. Here's a simplified breakdown of what the query does:

Data Source: The query examines data from CloudProcessEvents, which logs process activities in cloud environments.
Time Frame: It focuses on events that have occurred within the last hour (Timestamp > ago(1h)).
Detection Criteria: The query looks for specific patterns in the command lines of processes that might indicate a reverse shell attempt. These patterns include:
- Use of network device files like /dev/tcp/ or /dev/udp/.
- Execution of networking utilities such as nc, ncat, netcat, or busybox with flags or commands that redirect input/output to a network socket (e.g., -e, -c, /bin/sh, /bin/bash).
- Use of socat with commands like exec:, EXEC:, pty, or system:.
- Python scripts that use the socket module along with functions like pty.spawn, subprocess, or dup2.
- Perl scripts that use the socket module and exec function.
Output: The query projects (selects) specific fields from the detected events for further analysis, including:
- Timestamp: When the event occurred.
- ReportId: Identifier for the report.
- AzureResourceId: The Azure resource ID associated with the event.
- KubernetesNamespace, KubernetesPodName, ContainerName, ContainerImageName: Information about the Kubernetes environment.
- AccountName: The account under which the process ran.
- ParentProcessName, ProcessName, ProcessCommandLine: Details about the process that was executed.

Overall, this query helps security analysts identify suspicious activities that might indicate an attacker is trying to establish a reverse shell within a Kubernetes environment, which is a common technique used for unauthorized remote access.