Create or Modify System Process: Container Service T1543.005

Tactics: Persistence, Privilege Escalation

Adversaries may create or modify container or container cluster management tools that run as daemons, agents, or services on individual hosts. These include software for creating and managing individual containers, such as Docker and Podman, as well as container cluster node-level agents such as kubelet. By modifying these services, an adversary may be able to achieve persistence or escalate their privileges on a host.

Authoring guide

These 2 rules share fields, values, and exclusions.

Fields filtered most (7 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
host.os.type2eq 2
EventType1in 1exec, executed
TargetFilename1wildcard 1/etc/kubernetes/*.conf, /etc/kubernetes/manifests/*, /etc/kubernetes/pki/*
event.category1eq 1process
event.type1ne 1deletion
process.args1contains 1/etc/kubernetes/manifests/
process_name1eq 1, starts_with 1., awk, base64

Top indicator values (37 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
EventTypein
exec
1206
EventTypein
executed
198
TargetFilenamewildcard
/etc/kubernetes/*.conf
1
TargetFilenamewildcard
/etc/kubernetes/manifests/*
1
TargetFilenamewildcard
/etc/kubernetes/pki/*
1
event.categoryeq
process
1141
event.typene
deletion
132
process.argscontains
/etc/kubernetes/manifests/
1
process_nameeq
awk
110
process_nameeq
base64
19
process_nameeq
bash
112
process_nameeq
busybox
112
process_nameeq
cat
17
process_nameeq
cp
19
process_nameeq
curl
129
process_nameeq
dash
19
process_nameeq
dd
110
process_nameeq
echo
1
process_nameeq
mv
14
process_nameeq
nano
1
process_nameeq
node
125
process_nameeq
openssl
128
process_nameeq
scp
15
process_nameeq
sed
14
process_nameeq
sh
112
process_nameeq
tee
14
process_nameeq
touch
16
process_nameeq
vi
1
process_nameeq
vim
1
process_nameeq
wget
119

Exclusions (17 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
CurrentDirectorywildcard
/home/*-svc-nessus
1
ParentImagein
/opt/nessus/sbin/nessusd
1
ParentImagein
/opt/nessus_agent/sbin/nessus-agent-module
1
file.extensionin
swp
1
file.extensionin
swx
1
process.argsstarts_with
/etc/kubernetes/manifests/etcd
1
process.argsstarts_with
/etc/kubernetes/manifests/kube-apiserver
1
process.argsstarts_with
/etc/kubernetes/manifests/kube-controller-manager
1
process.argsstarts_with
/etc/kubernetes/manifests/kube-scheduler
1
process.argsstarts_with
printf
1
process_namein
dpkg
1
process_namein
kubeadm
1
process_namein
kubelet
1
process_namein
sed
1
process_namein
vi
1

Rules under this technique

These vendors publish rules tagged with this technique.

Domain: Endpoint

Platform (all)

Elastic 2 rules