Ruben Groenewoud
c5b64c9fbf
* [New/Tuning] General API Abuse D4C/K8s Rules * [New Rule] DNS Enumeration Detected via Defend for Containers * [New Rule] Tool Enumeration Detected via Defend for Containers * [New Rule] Tool Installation Detected via Defend for Containers * Service Account File Reads * [New Rule] Direct Interactive Kubernetes API Request Detected via Defend for Containers * Rule name update * [New Rules] D4C K8S MDA API Request Rules * Add 'tor' to the list of allowed process args * ++ * ++ * Update rules/integrations/kubernetes/execution_user_exec_to_pod.toml Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> * Update description * Update rules/integrations/cloud_defend/execution_tool_installation.toml Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com> * Update rules/integrations/cloud_defend/execution_tool_installation.toml Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com> * Update rules/integrations/cloud_defend/execution_tool_installation.toml * Update non-ecs-schema.json --------- Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
81 lines
3.0 KiB
TOML
81 lines
3.0 KiB
TOML
[metadata]
|
|
creation_date = "2026/01/21"
|
|
integration = ["cloud_defend"]
|
|
maturity = "production"
|
|
min_stack_comments = "Defend for Containers integration was re-introduced in 9.3.0"
|
|
min_stack_version = "9.3.0"
|
|
updated_date = "2026/01/21"
|
|
|
|
[rule]
|
|
author = ["Elastic"]
|
|
description = """
|
|
This rule detects the execution of the "env" or "printenv" commands inside a container. The "env" command is used
|
|
to display all the environment variables for the current shell, and the "printenv" command is used to print the
|
|
values of environment variables. These commands are used to enumerate the environment variables of the container,
|
|
which can be used by an adversary to gain information about the container and the services running inside it.
|
|
"""
|
|
false_positives = [
|
|
"""
|
|
There is a potential for false positives if the "env" or "printenv" commands are used for legitimate purposes,
|
|
such as debugging or troubleshooting. It is important to investigate any alerts generated by this rule to determine
|
|
if they are indicative of malicious activity or part of legitimate container activity.
|
|
""",
|
|
]
|
|
from = "now-6m"
|
|
index = ["logs-cloud_defend.process*"]
|
|
interval = "5m"
|
|
language = "eql"
|
|
license = "Elastic License v2"
|
|
name = "Environment Variable Enumeration Detected via Defend for Containers"
|
|
risk_score = 21
|
|
rule_id = "f66a6869-d4c7-4d20-ab13-beefd03b63b4"
|
|
severity = "low"
|
|
tags = [
|
|
"Data Source: Elastic Defend for Containers",
|
|
"Domain: Container",
|
|
"OS: Linux",
|
|
"Use Case: Threat Detection",
|
|
"Tactic: Discovery",
|
|
]
|
|
timestamp_override = "event.ingested"
|
|
type = "eql"
|
|
query = '''
|
|
process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and (
|
|
process.name in ("env", "printenv") or
|
|
(
|
|
/* Account for tools that execute utilities as a subprocess, in this case the target utility name will appear as a process arg */
|
|
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "busybox") and
|
|
process.args in (
|
|
"env", "/bin/env", "/usr/bin/env", "/usr/local/bin/env",
|
|
"printenv", "/bin/printenv", "/usr/bin/printenv", "/usr/local/bin/printenv"
|
|
) and
|
|
/* default exclusion list to not FP on default multi-process commands */
|
|
not process.args in (
|
|
"which", "/bin/which", "/usr/bin/which", "/usr/local/bin/which",
|
|
"man", "/bin/man", "/usr/bin/man", "/usr/local/bin/man",
|
|
"chmod", "/bin/chmod", "/usr/bin/chmod", "/usr/local/bin/chmod",
|
|
"chown", "/bin/chown", "/usr/bin/chown", "/usr/local/bin/chown"
|
|
)
|
|
)
|
|
) and
|
|
process.interactive == true and container.id like "*"
|
|
'''
|
|
|
|
[[rule.threat]]
|
|
framework = "MITRE ATT&CK"
|
|
|
|
[[rule.threat.technique]]
|
|
id = "T1613"
|
|
name = "Container and Resource Discovery"
|
|
reference = "https://attack.mitre.org/techniques/T1613/"
|
|
|
|
[[rule.threat.technique]]
|
|
id = "T1082"
|
|
name = "System Information Discovery"
|
|
reference = "https://attack.mitre.org/techniques/T1082/"
|
|
|
|
[rule.threat.tactic]
|
|
id = "TA0007"
|
|
name = "Discovery"
|
|
reference = "https://attack.mitre.org/tactics/TA0007/"
|