---
title: Azure AKS Kubelet Proxy to Command Execution Endpoint
description: Detects use of the AKS (Azure Kubernetes Service) API server nodes/proxy subresource to reach a node's Kubelet command-execution endpoints (run, exec,...
url: https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/azure/execution_azure_aks_kubelet_proxy_command_endpoint
products:
  - Elastic Security
---

# Azure AKS Kubelet Proxy to Command Execution Endpoint
Detects use of the AKS (Azure Kubernetes Service) API server nodes/proxy subresource to reach a node's Kubelet
command-execution endpoints (run, exec, attach, portforward, cri). Unlike benign monitoring that scrapes /metrics and
/stats, a request to these endpoints executes commands inside a pod on the node, the core of the kubeletctl and Peirates
lateral-movement technique. Even a GET to /exec is command execution because the Kubelet maps the WebSocket upgrade
handshake to the RBAC get verb, so nodes/proxy GET is sufficient for remote code execution.
**Rule type**: query
**Rule indices**:
- logs-azure.platformlogs-*

**Rule Severity**: high
**Risk Score**: 73
**Runs every**: 
**Searches indices from**: `now-9m`
**Maximum alerts per execution**: 100
**References**:
- [[https://horizon3.ai/attack-research/when-read-only-isnt-k8s-nodes-proxy-get-to-rce/](https://horizon3.ai/attack-research/when-read-only-isnt-k8s-nodes-proxy-get-to-rce/)](https://horizon3.ai/attack-research/when-read-only-isnt-k8s-nodes-proxy-get-to-rce/)
- [[https://stratus-red-team.cloud/attack-techniques/kubernetes/k8s.privilege-escalation.nodes-proxy/](https://stratus-red-team.cloud/attack-techniques/kubernetes/k8s.privilege-escalation.nodes-proxy/)](https://stratus-red-team.cloud/attack-techniques/kubernetes/k8s.privilege-escalation.nodes-proxy/)
- [[https://www.cyberark.com/resources/threat-research-blog/using-kubelet-client-to-attack-the-kubernetes-cluster](https://www.cyberark.com/resources/threat-research-blog/using-kubelet-client-to-attack-the-kubernetes-cluster)](https://www.cyberark.com/resources/threat-research-blog/using-kubelet-client-to-attack-the-kubernetes-cluster)
- [[https://microsoft.github.io/Threat-Matrix-for-Kubernetes/](https://microsoft.github.io/Threat-Matrix-for-Kubernetes/)](https://microsoft.github.io/Threat-Matrix-for-Kubernetes/)
- [[https://github.com/inguardians/peirates](https://github.com/inguardians/peirates)](https://github.com/inguardians/peirates)
- [[https://grahamhelton.com/blog/nodes-proxy-rce](https://grahamhelton.com/blog/nodes-proxy-rce)](https://grahamhelton.com/blog/nodes-proxy-rce)

**Tags**:
- Domain: Cloud
- Domain: Kubernetes
- Data Source: Azure
- Data Source: Azure Platform Logs
- Data Source: Kubernetes
- Use Case: Threat Detection
- Tactic: Execution
- Tactic: Lateral Movement
- Resources: Investigation Guide
- Noise: Unknown
- Performance: Fast
- Rule Type: Custom Query (KQL)
- Platform: Azure
- Platform: Kubernetes
- Domain: Containers

**Version**: 2
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2
The Azure Fleet integration collecting AKS diagnostic logs with the `kube-audit` category forwarded through Event Hub into the `azure.platformlogs` data stream is required for this rule.

## Investigation guide


## Triage and analysis


### Investigating Azure AKS Kubelet Proxy to Command Execution Endpoint

AKS kube-audit events are carried under the flattened `azure.platformlogs.properties.log.*` subtree and share the ARM
operation `event.action: Microsoft.ContainerService/managedClusters/diagnosticLogs/Read`. This rule keys on the Kubelet
endpoint in `azure.platformlogs.properties.log.requestURI`: `/proxy/run`, `/proxy/exec`, `/proxy/attach`,
`/proxy/portforward`, and `/proxy/cri` execute commands in a pod on the target node, whereas monitoring uses `/metrics`
and `/stats`. Any hit here is high-signal command execution regardless of the acting identity, including a stolen
monitoring service-account token.

### Possible investigation steps

- Confirm the endpoint and target in `azure.platformlogs.properties.log.requestURI` (the path encodes
  `/<endpoint>/<namespace>/<pod>/<container>`) and the acting identity in
  `azure.platformlogs.properties.log.user.username`.
- Evaluate `azure.platformlogs.properties.log.sourceIPs`. This is an array; for an externally operated attack the first
  element is the operator's real client IP and the trailing entry is the internal API-server/konnectivity hop
  (`172.31.x`). A first entry that is not the cluster's own egress is a strong signal.
- Determine what the target pod runs and what secrets or tokens it exposes, and whether the identity should reach the
  Kubelet at all.
- Correlate with prior recon (`/proxy/pods`, `/proxy/runningpods`) and follow-on RBAC changes, secret reads, or token
  requests from the same identity.


### False positive analysis

- Direct use of Kubelet exec endpoints via nodes/proxy is uncommon; validate any administrative debugging tool that
  proxies exec and exclude verified operators.


### Response and remediation

- Treat as active command execution on a node. Revoke the acting identity's tokens, isolate the affected node and pods,
  and rotate credentials reachable from them.
- Review the RBAC that granted `nodes/proxy` and remove it from workload identities that do not require it.
- Note that direct Kubelet access on port 10250 bypasses the API server and is not in kube-audit; a confirmed proxy exec
  may indicate broader Kubelet access.
- Collect kube-audit and identity artifacts per incident response procedures.


## Rule Query

```kuery
data_stream.dataset:azure.platformlogs and
  event.action:"Microsoft.ContainerService/managedClusters/diagnosticLogs/Read" and
  azure.platformlogs.category:"kube-audit" and
  azure.platformlogs.properties.log.objectRef.resource:"nodes" and
  azure.platformlogs.properties.log.objectRef.subresource:"proxy" and
  azure.platformlogs.properties.log.requestURI:(
    */proxy/run/* or */proxy/exec* or */proxy/attach* or
    */proxy/portforward* or */proxy/portForward* or */proxy/cri/*
  ) and
  not azure.platformlogs.properties.log.user.username:(
    system\:node\:* or "aksService" or "hcpService" or "readinessChecker"
  )
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Execution
  - Id: TA0002
  - Reference URL: [[https://attack.mitre.org/tactics/TA0002/](https://attack.mitre.org/tactics/TA0002/)](https://attack.mitre.org/tactics/TA0002/)
- Technique:
  - Name: Container Administration Command
  - Id: T1609
  - Reference URL: [[https://attack.mitre.org/techniques/T1609/](https://attack.mitre.org/techniques/T1609/)](https://attack.mitre.org/techniques/T1609/)

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Lateral Movement
  - Id: TA0008
  - Reference URL: [[https://attack.mitre.org/tactics/TA0008/](https://attack.mitre.org/tactics/TA0008/)](https://attack.mitre.org/tactics/TA0008/)
- Technique:
  - Name: Exploitation of Remote Services
  - Id: T1210
  - Reference URL: [[https://attack.mitre.org/techniques/T1210/](https://attack.mitre.org/techniques/T1210/)](https://attack.mitre.org/techniques/T1210/)