Container CLI used to run a shell inside a running container

Siemphony@siemphonylowT1059.013unverified

Matches the CLI half of AN0233: one of the container management clients the analytic names — docker, kubectl and crictl, joined here by the closely related podman and nerdctl — invoked with an exec verb, where the command handed into the container is an interpreted shell. The analytic names sh, bash and python; ash, zsh and dash are added here. All three conditions are required together, because the client on its own is ordinary tooling and exec on its own appears in unrelated command lines; it is the combination that says an operator or an adversary is running arbitrary commands inside a container rather than deploying one. The shell gate is split in two so that it carries a word boundary Sigma has no operator for: a shell path, or a shell name followed by an argument, or a shell name at the end of the command line. A bare contains on ' sh' would also match ' sha256sum' and ' shutdown' and would report those as an opened shell. Three limits are structural. The API and SDK route the technique describes — the Docker SDK for Python, curl against /var/run/docker.sock, or the Kubernetes API called with a pod service account — executes none of these binaries and produces no match here at all; only the CLI arm is covered. The process that actually runs inside the container is started by the daemon through containerd-shim and runc, not as a child of the client, so no parent lineage links the two events and MITRE's TimeWindow knob for correlating the exec with the shell spawn and its network activity has no Sigma construct behind it. And an exec that runs a non-shell command (docker exec c whoami, kubectl exec pod -- cat /etc/shadow) is deliberately outside this rule; the shell gate is what keeps the volume survivable, and it costs that coverage. The brief maps auditd SYSCALL execve onto Sigma's process_creation category, which is Sysmon-shaped, so this rule is written in that vocabulary (Image, CommandLine) and an auditd feed needs exe mapped onto Image and the a0/a1 argv fields reconstructed into a single CommandLine string before any of it matches. Prerequisite: no distribution audits execve by default, so this rule returns zero rows until a rule such as `-a always,exit -F arch=b64 -S execve -k exec` is loaded — and zero rows reads as quiet when it actually means blind. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0083, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (((FolderPath endswith "/docker" or FolderPath endswith "/kubectl" or FolderPath endswith "/crictl" or FolderPath endswith "/podman" or FolderPath endswith "/nerdctl") and ProcessCommandLine contains " exec ") and ((ProcessCommandLine contains "/bin/sh" or ProcessCommandLine contains "/bin/bash" or ProcessCommandLine contains "/bin/ash" or ProcessCommandLine contains "/bin/zsh" or ProcessCommandLine contains "/bin/dash" or ProcessCommandLine contains " sh " or ProcessCommandLine contains " bash " or ProcessCommandLine contains " ash " or ProcessCommandLine contains " zsh " or ProcessCommandLine contains " dash " or ProcessCommandLine contains " python") or (ProcessCommandLine endswith " sh" or ProcessCommandLine endswith " bash" or ProcessCommandLine endswith " ash" or ProcessCommandLine endswith " zsh" or ProcessCommandLine endswith " dash")))

Splunk · SPL

Run this as a search.

index=* (((Image="*/docker" OR Image="*/kubectl" OR Image="*/crictl" OR Image="*/podman" OR Image="*/nerdctl") AND CommandLine="* exec *") AND ((CommandLine="*/bin/sh*" OR CommandLine="*/bin/bash*" OR CommandLine="*/bin/ash*" OR CommandLine="*/bin/zsh*" OR CommandLine="*/bin/dash*" OR CommandLine="* sh *" OR CommandLine="* bash *" OR CommandLine="* ash *" OR CommandLine="* zsh *" OR CommandLine="* dash *" OR CommandLine="* python*") OR (CommandLine="* sh" OR CommandLine="* bash" OR CommandLine="* ash" OR CommandLine="* zsh" OR CommandLine="* dash")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((TO_LOWER(process.executable) LIKE "*/docker" OR TO_LOWER(process.executable) LIKE "*/kubectl" OR TO_LOWER(process.executable) LIKE "*/crictl" OR TO_LOWER(process.executable) LIKE "*/podman" OR TO_LOWER(process.executable) LIKE "*/nerdctl") AND TO_LOWER(process.command_line) LIKE "* exec *") AND ((TO_LOWER(process.command_line) LIKE "*/bin/sh*" OR TO_LOWER(process.command_line) LIKE "*/bin/bash*" OR TO_LOWER(process.command_line) LIKE "*/bin/ash*" OR TO_LOWER(process.command_line) LIKE "*/bin/zsh*" OR TO_LOWER(process.command_line) LIKE "*/bin/dash*" OR TO_LOWER(process.command_line) LIKE "* sh *" OR TO_LOWER(process.command_line) LIKE "* bash *" OR TO_LOWER(process.command_line) LIKE "* ash *" OR TO_LOWER(process.command_line) LIKE "* zsh *" OR TO_LOWER(process.command_line) LIKE "* dash *" OR TO_LOWER(process.command_line) LIKE "* python*") OR (TO_LOWER(process.command_line) LIKE "* sh" OR TO_LOWER(process.command_line) LIKE "* bash" OR TO_LOWER(process.command_line) LIKE "* ash" OR TO_LOWER(process.command_line) LIKE "* zsh" OR TO_LOWER(process.command_line) LIKE "* dash")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,linux,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(/docker$|/kubectl$|/crictl$|/podman$|/nerdctl$)</field>    <field name="CommandLine" type="pcre2">(?i) exec </field>    <field name="CommandLine" type="pcre2">(?i)((/bin/sh|/bin/bash|/bin/ash|/bin/zsh|/bin/dash| sh | bash | ash | zsh | dash | python)|( sh$| bash$| ash$| zsh$| dash$))</field>    <description>Container CLI used to run a shell inside a running container</description>    <mitre>      <id>T1059.013</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / linux
Level: low
Category: script_interpreter_execution
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 8ea173a7-1769-48e7-a223-25483873d5a0

ATT&CKT1059.013

T1059.013Container CLI/API

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonscript interpreter execution

script interpreter executionAI draft — unreviewed

01 · What this rule detects

One narrow move: a container management client on a Linux host asked to run an interpreted shell inside a container that is already running — kubectl exec -it web -- /bin/bash, docker exec -it db sh. AN0233 names docker exec and kubectl exec as the observable for T1059.013, so this framing is MITRE's rather than the pipeline's. Worth knowing: the same event is the primary observable for T1609 Container Administration Command, and a triager will have to decide which label it files under. Only the CLI half is covered. The Docker SDK for Python, curl against /var/run/docker.sock, and the Kubernetes API called with a pod service account reach the same outcome and execute none of the gated binaries. A clean board here says nothing about those routes.

02 · Telemetry you need

process_creation on product: linux, copied from AN0233. The brief maps auditd SYSCALL/execve onto that Sigma category, which is Sysmon-shaped, so the rule is written in Image/CommandLine. An auditd feed does not match as-is: exe= must be mapped onto Image and the a0/a1 argv fields reconstructed into one CommandLine string first.
No distribution audits execve by default. Until a rule like -a always,exit -F arch=b64 -S execve -k exec is loaded, this returns zero rows — and zero rows reads as quiet when it means blind.

03 · How the logic works

Three conditions, all required together. selection_client gates Image|endswith on /docker, /kubectl, /crictl, /podman, /nerdctl — the first three named by AN0233, the last two added here as close relatives. selection_exec requires ' exec '. Neither alone means anything: the client is ordinary tooling, and exec appears in unrelated command lines. The third condition is the interesting one. Sigma has no word-boundary operator, so a bare contains: ' sh' also matches sha256sum, shutdown and showmount and reports them as an opened shell. The gate is therefore split in two: selection_shell_arg carries the full paths (/bin/sh, /bin/bash, …) plus the space-delimited forms (' sh ', ' bash '), while selection_shell_tail uses CommandLine|endswith for the shell-at-end-of-line form. ' python' stays a bare prefix on purpose, so python3.11 still matches. AN0233 lists sh, bash and python; ash, zsh and dash are the pipeline's own additions. An exec running a non-shell command — docker exec c whoami — is deliberately outside the rule. The shell gate is what keeps the volume survivable, and that coverage is what it costs.

04 · Common false positives

Loudly, and from humans. kubectl exec -it pod -- /bin/bash is the first step of every on-call investigation. CI/CD runners exec in for migrations and smoke tests on every pipeline run. Ansible's community.docker and kubernetes.core modules invoke the same clients on every convergence. Nightly docker exec db sh -c 'pg_dump …' wrappers fire once per host per schedule.
That is why the rule is level: low. Its loudest false positive is also its highest-volume match by a wide margin, and a level contradicting a rule's own first false positive is a calibration failure.

05 · Detection maturity

tier_1: Lowest tier, and it stays there. This rule has never been run against a single log line — it is machine-derived from MITRE ATT&CK v19.2 and carries the UNVERIFIED label for exactly that reason. It only moves up once someone points it at real telemetry, confirms the field mapping resolves, and measures the false positive rate instead of predicting it.

Tuning & false positivesexperimental · 5 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

MITRE's AuthorizedUserAgents knob is where the runners, SRE tools and cluster agents allowed to do this get recorded — a list nobody can populate in advance for someone else's estate. InteractiveSessionExpectation decides whether TTY-less shell spawns are the interesting subset in your deployment model. TimeWindow (MITRE's default: two minutes) correlates the exec with a shell spawn and following network activity, but has no Sigma construct behind it: the in-container process is started by the daemon through containerd-shim and runc, not as a child of the client, so no parent lineage joins the two events.
Two silent misses to close by hand: /docker-compose, and the OpenShift /oc client whose oc exec is kubectl's verb renamed.

Declared by the author

Engineers debugging live workloads. kubectl exec -it <pod> -- /bin/bash and docker exec -it <container> sh are the normal first step of every on-call investigation and every developer's day in a Kubernetes or Compose shop, so on any cluster with human operators this is the highest-volume match by a wide margin, which is why this rule is low rather than medium. MITRE's AuthorizedUserAgents knob is the place to record which accounts and hosts may do it, and that list cannot be written in advance for someone else's estate.
CI/CD pipelines and deployment jobs. GitLab runners, Jenkins agents and Argo hooks routinely run docker exec app sh -c 'rake db:migrate' or kubectl exec for post-deploy migrations and smoke tests, producing a match on every pipeline run from a service account at a predictable point in the build.
Scheduled maintenance wrappers, where a cron entry or a backup agent shells into a database container as docker exec db sh -c 'pg_dump ...' or 'mysqldump ...' every night — a fixed, repeating match per host per schedule.
Configuration management convergence, where the Ansible community.docker and kubernetes.core modules implement their exec actions by invoking the same clients, so every managed container produces a match on every run whether or not anything changed.
Container image build and test harnesses on a developer laptop, where a Makefile or a test script runs docker exec build sh -c 'make check' on every local iteration, producing a burst of matches from an interactive user with no service account to filter on.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1059.013, evaluated against their process_creation events.

Share this rule

/u/siemphony/8ea173a7-1769-48e7-a223-25483873d5a0

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Container CLI used to run a shell inside a running container

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it