Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Container Runtime CLI Execution with Suspicious Arguments

Detects execution of container runtime CLI tools (ctr, crictl, nerdctl) with arguments indicating container creation, command execution inside existing containers, image manipulation, or host filesystem mounting. These tools interact directly with the container runtime socket, bypassing the Kubernetes API server, RBAC authorization, admission webhooks, pod security standards, and Kubernetes audit logging entirely. Attackers with host-level access may use these tools to create privileged ghost containers, exec into other pods to steal service account tokens and secrets, pull attacker-controlled images, and destroy evidence, all while remaining invisible to Kubernetes-level monitoring.

ATT&CK coverage

Outside the enterprise matrix

Detection requirements

Log source category: event_index

What the source says

What fires this without an attack behind it

Platform automation, node bootstrap, and legitimate break-glass admin sessions may use these CLIs with overlapping arguments. Tune by parent process, user, or host role (worker vs bastion).

References

Tagged by the source as

Data Source: Auditd ManagerData Source: Elastic DefendDomain: ContainerDomain: EndpointOS: LinuxResources: Investigation GuideTactic: ExecutionUse Case: Threat Detection

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.