Container started with a persistent restart policy

1title: Container started with a persistent restart policy2id: 980679e3-9a2f-4164-8339-42879b80211a3status: experimental4description: |5  Matches an auditd execve of the docker, podman or nerdctl client whose6  arguments set a container restart policy of always or unless-stopped, which is7  the mechanism this technique uses to make a container — and whatever it runs8  inside — come back on its own after every host reboot. The client list is9  authored for this rule: MITRE's technique text names docker and podman, and10  nerdctl is added here as the containerd client that accepts the same flag. The11  policy strings are MITRE's restartPolicy knob, populated here with both12  spellings the CLI accepts, equals-separated and space-separated, so a13  space-separated invocation is not silently missed. A `docker update14  --restart=always` against an already-running container matches the same15  selection, which is intended — it is the same persistence with one step fewer.16  Three limits are structural. The flag has to be on the command line: a17  `restart:` key in a compose file, a Podman Quadlet `.container` unit or a18  `podman generate systemd` wrapper sets exactly the same policy with no flag19  for this rule to see, and `docker compose up` does not match the client20  selection either, so declarative deployments are a blind spot. The Kubernetes21  half of AN1304 — DaemonSets, and22  pods pinned to a host with nodeSelector or nodeName — is invisible from here,23  because those settings live in a manifest that `kubectl apply -f` never places24  on the command line; catching them needs the Kubernetes audit log, which this25  brief does not offer. And the analytic's correlation of a container launch26  with a later privilege escalation inside MITRE's TimeWindow knob is a27  cross-event join lib/sigma cannot express, so this rule sees only the28  persistence half. The brief's second log source, systemd unit files, is not29  attempted: it carries no standardised Sigma field names, and inventing them30  would produce a rule that renders in four backends and matches nothing.31  Prerequisite: auditd does not record execve in a default install, so this rule32  returns zero rows until a rule such as `-a always,exit -F arch=b64 -S execve`33  is loaded, and zero rows reads as quiet when it actually means blind.34  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0473, not hand-written and not tested by its author. Any lab result is on this rule's own page.35references:36  - https://attack.mitre.org/techniques/T1543/00537  - https://attack.mitre.org/detectionstrategies/DET047338author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)39date: 2026-08-1640tags:41  - attack.persistence42  - attack.privilege-escalation43  - attack.t1543.00544logsource:45  category: process_creation46  product: linux47detection:48  selection_client:49    Image|endswith:50      - '/docker'51      - '/podman'52      - '/nerdctl'53  selection_policy:54    CommandLine|contains:55      - '--restart=always'56      - '--restart always'57      - '--restart=unless-stopped'58      - '--restart unless-stopped'59  condition: selection_client and selection_policy60falsepositives:61  - "Ordinary production operation, which is the loudest match by a wide margin and the reason the level is low. Long-lived service containers — reverse proxies, databases, message brokers, monitoring and log-shipping agents — are routinely started with an always or unless-stopped policy because the runtime documentation recommends exactly that for anything expected to survive a reboot."62  - "Provisioning and configuration management re-issuing the same command on every converge. Ansible shell tasks, cloud-init runcmd blocks, Terraform remote-exec provisioners and hand-rolled deployment scripts run the identical docker run line each time they execute, so a fleet-wide converge produces one match per host regardless of whether anything actually changed."63  - "An operator repairing a container that failed to come back after maintenance by running docker update with a restart policy against the existing container, which is a documented remediation and matches the same selection as the initial creation."64  - "Developer workstations and CI runners bringing up local stacks by hand, where the same command with a restart flag may be typed or scripted many times a day and where auditd, if enabled at all, is usually enabled fleet-wide."65level: low