Suspicious Shell And Tooling Activity In Containerized Environment

Query

let Lookback = 1d;
CloudProcessEvents
| where Timestamp > ago(Lookback)
| where isnotempty(KubernetesPodName)
| extend Command = tolower(ProcessCommandLine), Proc = tolower(ProcessName), Parent = tolower(ParentProcessName)
| where Proc in ("bash", "sh", "dash", "zsh", "nc", "ncat", "netcat", "socat", "python", "python3", "perl", "ruby", "php")
	or Command has_any ("/dev/tcp/", "bash -i", "sh -i", "mkfifo", "curl ", "wget ", "| sh", "| bash", "base64 -d", "base64 --decode", "chmod +x", "nohup ")
| where not(Command has_any ("readiness", "liveness", "healthcheck"))

About this query

Suspicious Shell and Tooling Activity in Containerized Environment

Query Information

MITRE ATT&CK Technique(s)

Technique ID	Title	Link
T1059	Command and Scripting Interpreter	https://attack.mitre.org/techniques/T1059
T1059.004	Unix Shell	https://attack.mitre.org/techniques/T1059/004
T1105	Ingress Tool Transfer	https://attack.mitre.org/techniques/T1105

Description

This rule detects the execution of suspicious command-line utilities, shells, or network tools within container environments. It identifies the use of interpreters like bash, sh, zsh, and python, as well as common network transfer tools like curl, wget, ncat, and socat, which are often leveraged by attackers for post-exploitation tasks such as reverse shell establishment, command-and-control communication, or file downloading. The rule includes filters for common container management processes such as liveness and readiness probes to minimize noise.

Author <Optional>

Name: Benjamin Zulliger
Github: https://github.com/benscha/KQLAdvancedHunting
LinkedIn: https://www.linkedin.com/in/benjamin-zulliger/

Defender XDR

Explanation

This query is designed to detect suspicious activities within containerized environments by monitoring the execution of certain command-line utilities, shells, and network tools. It focuses on identifying the use of interpreters and network transfer tools that attackers might use for malicious purposes, such as establishing reverse shells, communicating with command-and-control servers, or downloading files.

Here's a simplified breakdown of what the query does:

Time Frame: It looks at process events from the past day (Lookback = 1d).
Container Environment: It specifically targets events that occur within Kubernetes pods (isnotempty(KubernetesPodName)).
Command and Process Monitoring:
- It checks for the execution of specific shell interpreters and network tools like bash, sh, python, nc, curl, and wget.
- It also looks for certain command patterns that are indicative of suspicious behavior, such as using /dev/tcp/ for network communication, creating reverse shells (bash -i, sh -i), or downloading files (curl, wget).
Noise Reduction: The query filters out common container management processes like readiness, liveness, and healthcheck to reduce false positives and focus on genuinely suspicious activities.

Overall, this query helps security teams identify potential security threats in containerized environments by flagging unusual or unauthorized use of command-line tools and scripts.