Potential Sidecar Injection Into Running Deployment (ad9012a6-e518-4432-9890-f3b82b8fc71f)
Detects attempts to inject a sidecar container into a running deployment. A sidecar container is an additional container within a pod, that resides alongside the main container. One way to add containers to running resources like Deployments/DeamonSets/StatefulSets, is via a "kubectl patch" operation. By injecting a new container within a legitimate pod, an attacker can run their code and hide their activity, instead of running their own separated pod in the cluster.
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Container Administration Command - T1609 (7b50a1d3-4ca7-45d1-989d-a6503f04bfe1) | Attack Pattern | Potential Sidecar Injection Into Running Deployment (ad9012a6-e518-4432-9890-f3b82b8fc71f) | Sigma-Rules | 1 |