Detecting a Simulated TeamPCP Container Attack Chain
Summary
Elastic Security Labs walks through a simulated TeamPCP container attack chain, showing how Defend for Containers telemetry and Kubernetes audit logs can detect and correlate execution, persistence, cluster propagation, tunneling, and cryptomining.
Key points
- The simulated chain begins with interactive download-and-execute activity and checks for Kubernetes service-account tokens.
- Detection examples use process lineage, interactive execution, file writes, package installation, tunneling tools, encoded payloads, and binaries run from temporary directories.
- The scenario uses a downloaded kube.py script and a service-account token to enumerate Kubernetes resources and execute across the cluster.
- Writing a systemd service from inside a container is presented as anomalous activity that may indicate elevated privileges or possible host-level impact.
- Kubernetes audit-log detections cover API enumeration, privileged DaemonSet creation, broad ClusterRole permissions, and workloads configured with host access.
- The article explains that container runtime telemetry and Kubernetes audit logs reveal different parts of the chain; Attack Discovery correlated more than 130 simulated alerts into a single narrative.
Article Details
- Defense Focus
- Detect and correlate multi-stage container and Kubernetes compromises using runtime telemetry and control-plane audit logs.
- Detection Methods
- Correlate interactive curl or wget downloads with child shell or interpreter execution using process lineage, command lines, and container context.
- Detect remote file downloads followed by file creation and execution in the same container; exclude expected package-manager activity.
- Monitor container processes for service-account token checks, environment-variable enumeration, sensitive file discovery, and unusual Python-based Kubernetes API activity.
- Alert on writes to systemd, cron, sudoers, and shell-profile persistence locations originating from containers.
- Identify interactive package installation, tunneling and proxy processes, encoded-payload decoding, executable permission changes, and binary execution from temporary or other unusual paths.
- Use Kubernetes audit events to detect bursts of API enumeration, sensitive DaemonSet or workload creation, broad ClusterRole bindings, and pods requesting privileged mode, host namespaces, or host filesystem mounts.
- Data Sources
- Defend for Containers runtime process events, including process lineage, command-line arguments, interactive execution flags, and container identity
- Container file creation, modification, and permission-change events
- Kubernetes audit logs for API calls, resource enumeration, workload creation, and RBAC changes
- Correlated detection alerts from container runtime and Kubernetes control-plane telemetry
- Rule Types
- Elastic EQL process and file event rules
- EQL sequence rules correlating file creation and subsequent execution
- Kubernetes audit-log detection rules
- Cross-source alert correlation with Attack Discovery
- Platforms
- Linux container workloads
- Kubernetes control plane
- Defensive Actions
- Correlate Defend for Containers runtime alerts with Kubernetes audit logs to reconstruct activity across workloads and the control plane.
- Investigate interactive download-and-execute behavior, downloaded scripts, and newly created binaries in temporary directories.
- Review container-originated writes to persistence locations and determine whether host filesystem access or elevated privileges are involved.
- Examine service-account API activity, ClusterRole bindings, and DaemonSets for broad permissions or node-level access through privileged mode, host namespaces, or hostPath mounts.
- Treat runtime package installation and tunneling or proxy-tool execution in deployed containers as signals for investigation, especially when correlated with earlier alerts.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxp[:]//44[.]252[.]85[.]168:666/files/kube.py | URL used in the simulated scenario to download the script for Kubernetes pod and node enumeration. |
| URL | hxxp[:]//67[.]217[.]57[.]240:666/files/proxy.sh | Download-and-execute URL identified in the simulated TeamPCP attack scenario. |
MITRE ATT&CK
T1059.004 · Unix ShellThe scenario uses curl piped to a shell and Python interpreter execution, including a Python -c payload.T1078 · Valid AccountsThe attacker uses an existing Kubernetes service-account token to access the API and perform cluster actions.T1083 · File and Directory DiscoveryDropped scripts enumerate environment variables and sensitive file locations, including checking for a Kubernetes service-account token.T1090 · ProxyThe scenario deploys tunneling and proxy tooling, including frps and gost, for external connectivity and access to internal services.T1105 · Ingress Tool TransferThe attacker downloads proxy.sh and kube.py from remote URLs into the container.T1496 · Resource HijackingThe attacker reconstructs and executes a cryptominer from a base64-encoded payload to monetize compromised cluster resources.T1543.003 · Windows ServiceThe scenario attempts persistence by writing teampcp-react.service to a systemd service directory from inside a container.
Threat Actors
Malware
Vendors
Products
Attack DiscoveryCorrelating D4C runtime telemetry with Kubernetes audit logs and using Attack Discovery produces a coherent kill chain that maps execution, discovery, persistence, privilege escalation, C2, and impact.Defend for Containers (D4C)chain based on the TeamPCP cloud-native cryptojacking and ransomware operation, showing how Defend for Containers (D4C) telemetry surfaces each stage from initial execution through persistence, lateral movement,KubernetesBy mapping observable runtime behavior to detection logic and correlating D4C runtime events with Kubernetes audit logs, the analysis demonstrates how to detect complex, multi-stage compromises across containers and the
Tools
frpsAttackers stage tooling at runtime (apk/apt installs), deploy tunneling/proxy tools (frps, gost, socat, SSH) for external connectivity, and reconstruct and run a base64-encoded miner (xmrig) for monetization.GOSTAttackers stage tooling at runtime (apk/apt installs), deploy tunneling/proxy tools (frps, gost, socat, SSH) for external connectivity, and reconstruct and run a base64-encoded miner (xmrig) for monetization.kube.pyLateral movement is achieved by downloading and running a kube.py script that uses a stolen service account token to enumerate and execute across pods and nodes.SocatAttackers stage tooling at runtime (apk/apt installs), deploy tunneling/proxy tools (frps, gost, socat, SSH) for external connectivity, and reconstruct and run a base64-encoded miner (xmrig) for monetization.