{"id":"ad9012a6-e518-4432-9890-f3b82b8fc71f","title":"Potential Sidecar Injection Into Running Deployment","description":"Detects attempts to inject a sidecar container into a running deployment.\nA sidecar container is an additional container within a pod, that resides alongside the main container.\nOne way to add containers to running resources like Deployments/DeamonSets/StatefulSets, is via a \"kubectl patch\" operation.\nBy injecting a new container within a legitimate pod, an attacker can run their code and hide their activity, instead of running their own separated pod in the cluster.\n","author":"Leo Tsaousis (@laripping)","status":"test","level":"medium","date":"2024-03-26","modified":"","tags":["attack.t1609","attack.execution"],"technique_ids":["T1609"],"logsource":{"category":"application","product":"kubernetes","service":"audit"},"falsepositives":["Unknown"],"references":["https://kubernetes.io/docs/tasks/manage-kubernetes-objects/update-api-object-kubectl-patch","https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Sidecar%20Injection/"],"source_path":"rules/application/kubernetes/audit/kubernetes_audit_sidecar_injection.yml","source_sha256":"bfdf93c15a436841b011873be89b9e2b21089ed62f80438847b8045a4f7988a8","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/kubernetes/audit/kubernetes_audit_sidecar_injection.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Sidecar Injection Into Running Deployment\nid: ad9012a6-e518-4432-9890-f3b82b8fc71f\nstatus: test\ndescription: |\n    Detects attempts to inject a sidecar container into a running deployment.\n    A sidecar container is an additional container within a pod, that resides alongside the main container.\n    One way to add containers to running resources like Deployments/DeamonSets/StatefulSets, is via a \"kubectl patch\" operation.\n    By injecting a new container within a legitimate pod, an attacker can run their code and hide their activity, instead of running their own separated pod in the cluster.\nreferences:\n    - https://kubernetes.io/docs/tasks/manage-kubernetes-objects/update-api-object-kubectl-patch\n    - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Sidecar%20Injection/\nauthor: Leo Tsaousis (@laripping)\ndate: 2024-03-26\ntags:\n    - attack.t1609\n    - attack.execution\nlogsource:\n    category: application\n    product: kubernetes\n    service: audit\ndetection:\n    selection:\n        verb: 'patch'\n        apiGroup: 'apps'\n        objectRef.resource: 'deployments'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1609","id":"T1609","name":"Container Administration Command","page":"techniques/enterprise/T1609/"}],"data_path":"data/detection-rules/ad9012a6-e518-4432-9890-f3b82b8fc71f.json","kind":"sigma"}