Skip to content

Commit 6f2eafd

Browse files
authored
Refine EQL query for suspicious pod/container creation
1 parent 3473920 commit 6f2eafd

File tree

1 file changed

+4
-2
lines changed

1 file changed

+4
-2
lines changed

rules/linux/execution_suspicious_pod_or_container_creation_command_execution.toml

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,9 +45,11 @@ timestamp_override = "event.ingested"
4545
type = "eql"
4646
query = '''
4747
process where event.type == "start" and event.action in ("exec", "exec_event", "start", "ProcessRollup2", "executed", "process_started") and (
48-
(process.name == "kubectl" and process.args == "run" and process.args == "--restart=Never" and process.args == "--" and process.args in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish")) or
48+
(process.name == "kubectl" and process.args == "run" and process.args == "--restart=Never" and process.args == "--") or
4949
(process.name == "docker" and process.args == "run")
50-
) and process.command_line like~ (
50+
) and
51+
process.args in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and
52+
process.command_line like~ (
5153
"*atd*", "*cron*", "*/etc/rc.local*", "*/dev/tcp/*", "*/etc/init.d*", "*/etc/update-motd.d*", "*/etc/ld.so*", "*/etc/sudoers*", "*base64 *",
5254
"*/etc/profile*", "*/etc/ssh*", "*/home/*/.ssh/*", "*/root/.ssh*" , "*~/.ssh/*", "*autostart*", "*xxd *", "*/etc/shadow*", "*./.*",
5355
"*import*pty*spawn*", "*import*subprocess*call*", "*TCPSocket.new*", "*TCPSocket.open*", "*io.popen*", "*os.execute*", "*fsockopen*",

0 commit comments

Comments
 (0)