Suspicious Activity Detected In Containerized Environment

Query

CloudProcessEvents
| where Timestamp > ago(1h)
| where ContainerName != "host" and isnotempty(ContainerId)
| extend AF = parse_json(tostring(AdditionalFields))
| extend Cat = case(
    ProcessCommandLine has "169.254.169.254" and FileName !endswith "xtables-nft-multi", "IMDS",
    ProcessCommandLine contains "secrets/kubernetes.io/serviceaccount", "SAToken",
    tostring(AF.UpperLayer) =~ "True" or tostring(AF.Memfd) =~ "True", "Drift",
    ProcessCommandLine has_any ("xmrig", "stratum+tcp", "allow_writes"), "Mining",
    ProcessCommandLine has_any ("modprobe", "insmod"), "KernelModule",
    ProcessCommandLine contains "ld.so.preload", "LdPreload",
    ProcessName in~ ("nmap", "masscan", "zmap", "kube-hunter", "peirates", "kubeletctl"), "Recon",
    ProcessCommandLine has_any (".git-credentials", ".aws/credentials", "AZURE_CREDENTIAL_FILE", "access_token",
                                "/etc/kubernetes/azure.json", ".kube/config"), "CredHunting",
    ProcessName =~ "chmod" and ProcessCommandLine has "+x", "MakeExecutable",
    ProcessCommandLine has_any ("/proc/1/root", "release_agent", "docker.sock", "nsenter"), "Escape",
    ProcessCommandLine contains "/dev/tcp/", "ReverseShell",
    "")
| where isnotempty(Cat)
| summarize Timestamp = min(Timestamp), LastSeen = max(Timestamp), ReportId = any(ReportId),
            Categories = make_set(Cat), CategoryCount = dcount(Cat),
            Evidence = make_set(ProcessCommandLine, 30)
    by AzureResourceId, KubernetesNamespace, KubernetesPodName, ContainerName, ContainerImageName, AccountName,
       TimeWindow = bin(Timestamp, 30m)
| where CategoryCount >= 3
| extend Severity = "Critical"
| project-away TimeWindow

About this query

Suspicious Activity Detected in Containerized Environment

Query Information

MITRE ATT&CK Technique(s)

Technique ID	Title	Link
T1611	Escape to Host	https://attack.mitre.org/techniques/T1611
T1552.001	Credentials in Files	https://attack.mitre.org/techniques/T1552/001

Description

This rule monitors process execution within containers for a variety of high-fidelity suspicious behaviors, including container escape attempts, credential harvesting, resource hijacking (cryptomining), and unauthorized reconnaissance. It aggregates multiple distinct categories of malicious activity detected within a 30-minute window, triggering a 'Critical' severity alert when three or more distinct types of suspicious behaviors are identified for a specific container/pod.

Author <Optional>

Name: Benjamin Zulliger
Github: https://github.com/benscha/KQLAdvancedHunting
LinkedIn: https://www.linkedin.com/in/benjamin-zulliger/

Defender XDR

Explanation

This KQL query is designed to detect suspicious activities in a containerized environment by monitoring process executions within containers. Here's a simplified breakdown of what the query does:

Data Source: It examines events from CloudProcessEvents within the last hour.
Container Filtering: It filters out processes that are not running in a container (i.e., those with ContainerName equal to "host") and ensures that the ContainerId is not empty, indicating that the process is indeed running in a container.
Suspicious Activity Detection: The query looks for specific patterns in the command lines of processes to identify various suspicious activities, such as:
- IMDS: Accessing the instance metadata service.
- SAToken: Accessing Kubernetes service account tokens.
- Drift: Indicators of memory or upper-layer manipulations.
- Mining: Cryptomining activities.
- KernelModule: Loading kernel modules.
- LdPreload: Using ld.so.preload for potential malicious purposes.
- Recon: Reconnaissance tools like nmap or masscan.
- CredHunting: Searching for credential files.
- MakeExecutable: Changing file permissions to make them executable.
- Escape: Attempts to escape the container environment.
- ReverseShell: Establishing reverse shell connections.
Aggregation and Alerting: It aggregates these activities over a 30-minute window for each container/pod. If three or more distinct types of suspicious behaviors are detected, it triggers a 'Critical' severity alert.
Output: The query outputs relevant information about the suspicious activities, including the earliest and latest timestamps, the types of activities detected, and the command lines that triggered the detection, while excluding the time window from the final results.

Overall, this query is designed to provide early warning of potential security breaches in containerized environments by identifying and alerting on multiple types of suspicious activities within a short time frame.