New Unusual Process Execution In Container

Query

let Lookback = 14d;
let DetectWindow = 1h;
let Container = CloudProcessEvents
    | where Timestamp > ago(Lookback)
    | where ContainerName != "host" and isnotempty(ContainerId)
    | extend ImageRepo = tostring(split(ContainerImageName, ":")[0]);
let Known = Container
    | where Timestamp < ago(DetectWindow)
    | summarize by ImageRepo, ProcessName;
let ImagesWithHistory = Container
    | where Timestamp < ago(1d)
    | summarize by ImageRepo;       // nur Images mit mind. 1 Tag Historie bewerten (Rollouts ausklammern)
Container
| where Timestamp > ago(DetectWindow)
| join kind=inner ImagesWithHistory on ImageRepo
| join kind=leftanti Known on ImageRepo, ProcessName
| extend ShellParent = ParentProcessName in~ ("sh", "bash", "dash", "ash", "zsh", "busybox")
| extend Severity = iff(ShellParent, "High", "Medium")
| summarize Timestamp = min(Timestamp), ReportId = any(ReportId), NewProcesses = make_set(ProcessName, 20),
            CommandLines = make_set(ProcessCommandLine, 20), Severity = max(Severity)
    by AzureResourceId, KubernetesNamespace, KubernetesPodName, ContainerName, ImageRepo, AccountName

About this query

New Unusual Process Execution in Container

Query Information

MITRE ATT&CK Technique(s)

Technique ID	Title	Link
T1059	Command and Scripting Interpreter	https://attack.mitre.org/techniques/T1059
T1059.004	Unix Shell	https://attack.mitre.org/techniques/T1059/004

Description

Detects the execution of previously unseen processes within container environments. It identifies processes that have not been observed in the last 14 days and focuses on those running under shells like sh, bash, or zsh, flagging them with higher severity. This is useful for identifying unexpected or malicious behavior in container workloads.

Author <Optional>

Name: Benjamin Zulliger
Github: https://github.com/benscha/KQLAdvancedHunting
LinkedIn: https://www.linkedin.com/in/benjamin-zulliger/

Possible false positives

A system administrator or a dedicated service account runs a scheduled script, a software deployment patch, or a vulnerability scan across the network.
Helpdesk Escalation or On-Call Shift Support
IT Administrative "Jump Boxes"

Defender XDR

Explanation

This KQL query is designed to detect unusual process executions within container environments, focusing on identifying processes that haven't been observed in the last 14 days. Here's a simplified breakdown of what the query does:

Lookback and Detection Window: The query looks back over the past 14 days and focuses on processes executed within the last hour.
Filter for Containers: It filters events to only include those related to containers (excluding host processes) and ensures the container ID is present.
Image Repository Extraction: It extracts the repository name from the container image name for further analysis.
Known Processes: It identifies processes that have been seen before (older than the detection window) and groups them by image repository and process name.
Images with History: It considers only those container images that have been running for at least one day, excluding recent rollouts.
New Process Detection: It identifies new processes that have started within the detection window and have not been seen before in the known processes list.
Shell Parent Check: It checks if the parent process is a shell (like sh, bash, zsh, etc.) and assigns a higher severity ("High") if true, otherwise "Medium".
Summarization: The query summarizes the findings by various container and account attributes, providing details like the earliest timestamp, report ID, new process names, command lines, and the highest severity level detected.

This query helps in identifying unexpected or potentially malicious behavior in container workloads by flagging new and unusual process executions, especially those initiated by shell processes.