Suspicious Echo or Printf Execution Detected via Defend for Containers
This rule detects the execution of the echo/printf command to write data to potential persistence files, decode base64/32/16 and hex content or establish connections to a potential C2. The echo/printf commands are…
Description
This rule detects the execution of the echo/printf command to write data to potential persistence files, decode base64/32/16 and hex content or establish connections to a potential C2. The echo/printf commands are used to display a line of text or write data to a file. Threat actors may abuse the echo/printf commands to write data to files or file descriptors that are executed (by other processes or services) to establish persistence or escalate privileges.
Detection logic
Its licence does not clear it for publishing here
Sunturai publishes a detection's own text where the licence it arrived under has been reviewed and permits it, and Elastic License 2.0 has not. The query as its source wrote it, its canonical form and the hash that pins this revision are in the workspace record.
Detection requirements
- Platform
- ContainersESXiIaaSIdentity ProviderLinuxmacOSNetwork DevicesOffice SuiteSaaSWindows
The rule states no platform. This is derived from the 9 ATT&CK techniques it maps to.
- Log source category
- event_index
MITRE ATT&CK mappings
0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.
- T1037Boot or Logon Initialization ScriptsAlso under Privilege Escalation.34 detections cover this technique
- T1098Account ManipulationAlso under Privilege Escalation.409 detections cover this technique
- T1543Create or Modify System ProcessAlso under Privilege Escalation.118 detections cover this technique
- T1546Event Triggered ExecutionAlso under Privilege Escalation.106 detections cover this technique
References
| Reference | Cited by |
|---|---|
| flare.io/learn/resources/blog/teampcp-cloud-native-ransomware | 13 |
From the source
- At source
- Open at source
- Upstream identifier
- d9bfa475-270d-4b07-93cb-b1f49abe13da
- Tagged by the source as
- Data Source: Elastic Defend for ContainersDomain: ContainersNoise: UnknownOS: LinuxPerformance: NormalPlatform: LinuxResources: Investigation GuideRule Type: Event Correlation (EQL)Tactic: ExecutionTactic: PersistenceTactic: Privilege EscalationUse Case: Threat Detection
Licence
- Published under
- Elastic License 2.0Read the licence
- Attribution
- Required
Authorship
- Written by
- Published
- Sep 20, 2026
- Version
- 3