Container CLI used to run a shell inside a running container

1title: Container CLI used to run a shell inside a running container2id: 8ea173a7-1769-48e7-a223-25483873d5a03status: experimental4description: |5  Matches the CLI half of AN0233: one of the container management clients the6  analytic names — docker, kubectl and crictl, joined here by the closely7  related podman and nerdctl — invoked with an exec verb, where the command8  handed into the container is an interpreted shell. The analytic names sh,9  bash and python; ash, zsh and dash are added here. All three conditions are10  required together, because the client on its own is ordinary tooling and exec11  on its own appears in unrelated command lines; it is the combination that12  says an operator or an adversary is running arbitrary commands inside a13  container rather than deploying one. The shell gate is split in two so that14  it carries a word boundary Sigma has no operator for: a shell path, or a15  shell name followed by an argument, or a shell name at the end of the command16  line. A bare contains on ' sh' would also match ' sha256sum' and ' shutdown'17  and would report those as an opened shell.18  Three limits are structural. The API and SDK route the technique describes —19  the Docker SDK for Python, curl against /var/run/docker.sock, or the20  Kubernetes API called with a pod service account — executes none of these21  binaries and produces no match here at all; only the CLI arm is covered. The22  process that actually runs inside the container is started by the daemon23  through containerd-shim and runc, not as a child of the client, so no parent24  lineage links the two events and MITRE's TimeWindow knob for correlating the25  exec with the shell spawn and its network activity has no Sigma construct26  behind it. And an exec that runs a non-shell command (docker exec c whoami,27  kubectl exec pod -- cat /etc/shadow) is deliberately outside this rule; the28  shell gate is what keeps the volume survivable, and it costs that coverage.29  The brief maps auditd SYSCALL execve onto Sigma's process_creation category,30  which is Sysmon-shaped, so this rule is written in that vocabulary (Image,31  CommandLine) and an auditd feed needs exe mapped onto Image and the a0/a132  argv fields reconstructed into a single CommandLine string before any of it33  matches. Prerequisite: no distribution audits execve by default, so this rule34  returns zero rows until a rule such as35  `-a always,exit -F arch=b64 -S execve -k exec` is loaded — and zero rows36  reads as quiet when it actually means blind.37  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0083, not hand-written and not tested by its author. Any lab result is on this rule's own page.38references:39  - https://attack.mitre.org/techniques/T1059/01340  - https://attack.mitre.org/detectionstrategies/DET008341author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)42date: 2026-08-1643tags:44  - attack.execution45  - attack.t1059.01346logsource:47  category: process_creation48  product: linux49detection:50  selection_client:51    Image|endswith:52      - '/docker'53      - '/kubectl'54      - '/crictl'55      - '/podman'56      - '/nerdctl'57  selection_exec:58    CommandLine|contains: ' exec '59  selection_shell_arg:60    CommandLine|contains:61      - '/bin/sh'62      - '/bin/bash'63      - '/bin/ash'64      - '/bin/zsh'65      - '/bin/dash'66      - ' sh '67      - ' bash '68      - ' ash '69      - ' zsh '70      - ' dash '71      - ' python'72  selection_shell_tail:73    CommandLine|endswith:74      - ' sh'75      - ' bash'76      - ' ash'77      - ' zsh'78      - ' dash'79  condition: selection_client and selection_exec and (selection_shell_arg or selection_shell_tail)80falsepositives:81  - "Engineers debugging live workloads. kubectl exec -it <pod> -- /bin/bash and docker exec -it <container> sh are the normal first step of every on-call investigation and every developer's day in a Kubernetes or Compose shop, so on any cluster with human operators this is the highest-volume match by a wide margin, which is why this rule is low rather than medium. MITRE's AuthorizedUserAgents knob is the place to record which accounts and hosts may do it, and that list cannot be written in advance for someone else's estate."82  - "CI/CD pipelines and deployment jobs. GitLab runners, Jenkins agents and Argo hooks routinely run docker exec app sh -c 'rake db:migrate' or kubectl exec for post-deploy migrations and smoke tests, producing a match on every pipeline run from a service account at a predictable point in the build."83  - "Scheduled maintenance wrappers, where a cron entry or a backup agent shells into a database container as docker exec db sh -c 'pg_dump ...' or 'mysqldump ...' every night — a fixed, repeating match per host per schedule."84  - "Configuration management convergence, where the Ansible community.docker and kubernetes.core modules implement their exec actions by invoking the same clients, so every managed container produces a match on every run whether or not anything changed."85  - "Container image build and test harnesses on a developer laptop, where a Makefile or a test script runs docker exec build sh -c 'make check' on every local iteration, producing a burst of matches from an interactive user with no service account to filter on."86level: low