Pod or Container Creation with Suspicious Command-Line
This rule detects the creation of pods or containers that execute suspicious commands often associated with persistence or privilege escalation techniques. Attackers may use container orchestration tools like kubectl…
Description
This rule detects the creation of pods or containers that execute suspicious commands often associated with persistence or privilege escalation techniques. Attackers may use container orchestration tools like kubectl or container runtimes like docker to create pods or containers that run shell commands with arguments that indicate attempts to establish persistence (e.g., modifying startup scripts, creating backdoors).
Detection logic
Its licence does not clear it for publishing here
Sunturai publishes a detection's own text where the licence it arrived under has been reviewed and permits it, and Elastic License 2.0 has not. The query as its source wrote it, its canonical form and the hash that pins this revision are in the workspace record.
Detection requirements
- Platform
- ContainersESXiIaaSIdentity ProviderLinuxmacOSNetwork DevicesOffice SuiteSaaSWindows
The rule states no platform. This is derived from the 11 ATT&CK techniques it maps to.
- Log source category
- event_index
MITRE ATT&CK mappings
0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.
- T1053Scheduled Task/JobAlso under Persistence and Privilege Escalation.84 detections cover this technique
- T1059Command and Scripting Interpreter598 detections cover this technique
- T1574Hijack Execution FlowAlso under Stealth.93 detections cover this technique
- T1609Container Administration Command38 detections cover this technique
- T1610Deploy Container28 detections cover this technique
- T1037Boot or Logon Initialization ScriptsAlso under Privilege Escalation.34 detections cover this technique
- T1098Account ManipulationAlso under Privilege Escalation.409 detections cover this technique
- T1546Event Triggered ExecutionAlso under Privilege Escalation.106 detections cover this technique
- T1547Boot or Logon Autostart ExecutionAlso under Privilege Escalation.89 detections cover this technique
No references are available for this detection.
From the source
- At source
- Open at source
- Upstream identifier
- c595363f-52a6-49e1-9257-0e08ae043dbd
- Tagged by the source as
- Data Source: Auditd ManagerData Source: CrowdstrikeData Source: Elastic DefendData Source: Elastic EndgameData Source: SentinelOneDomain: ContainersDomain: EndpointNoise: MediumOS: LinuxPerformance: NormalPlatform: LinuxResources: Investigation GuideRule Type: Event Correlation (EQL)Tactic: ExecutionTactic: PersistenceTactic: Privilege EscalationUse Case: Threat Detection
Licence
- Published under
- Elastic License 2.0Read the licence
- Attribution
- Required
Authorship
- Written by
- Published
- Sep 20, 2026
- Version
- 3