---
title: Kubernetes Static Pod Manifest File Access
description: Detects Linux process executions where shells, editors, interpreters, or file/stream utilities reference /etc/kubernetes/manifests in process arguments...
url: https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/linux/persistence_kubernetes_static_pod_manifest_path_process_execution
products:
  - Elastic Security
---

# Kubernetes Static Pod Manifest File Access
Detects Linux process executions where shells, editors, interpreters, or file/stream utilities reference
/etc/kubernetes/manifests in process arguments. That directory holds static pod manifests read by the kubelet;
interaction via editors, downloaders, kubectl, redirection helpers (tee, dd), or scripting runtimes may indicate
staging or tampering with manifests for persistence or privileged workload placement. Pairs with file-telemetry rules
that flag direct manifest creation on container workloads.
**Rule type**: query
**Rule indices**:
- auditbeat-*
- logs-auditd_manager.auditd-*
- logs-endpoint.events.process*

**Rule Severity**: medium
**Risk Score**: 47
**Runs every**: 
**Searches indices from**: `now-9m`
**Maximum alerts per execution**: 100
**References**:
- [[https://kubernetes.io/docs/tasks/configure-pod-container/static-pod/](https://kubernetes.io/docs/tasks/configure-pod-container/static-pod/)](https://kubernetes.io/docs/tasks/configure-pod-container/static-pod/)
- [[https://attack.mitre.org/techniques/T1053/007/](https://attack.mitre.org/techniques/T1053/007/)](https://attack.mitre.org/techniques/T1053/007/)

**Tags**:
- Data Source: Auditd Manager
- Data Source: Elastic Defend
- Domain: Endpoint
- Domain: Kubernetes
- Domain: Containers
- OS: Linux
- Use Case: Threat Detection
- Tactic: Persistence
- Tactic: Privilege Escalation
- Resources: Investigation Guide
- Noise: Low
- Performance: Normal
- Rule Type: Custom Query (KQL)
- Platform: Linux

**Version**: 3
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2

## Setup

Requires **Elastic Defend** and/or **Auditd Manager** process telemetry (`logs-endpoint.events.process*`,
`logs-auditd_manager.auditd-*`, `auditbeat-*`) with command-line argument capture for exec events.

### Elastic Defend

Install the Elastic Defend integration via Fleet on Linux hosts and use a policy that collects process events with
arguments.

### Auditd Manager

Deploy Auditd Manager and ensure execve (or equivalent process) auditing is enabled so `process.args` and
`process.executable` populate for monitored binaries.
See [https://docs.elastic.co/integrations/auditd_manager](https://docs.elastic.co/integrations/auditd_manager)

## Investigation guide


## Triage and analysis


### Investigating Kubernetes Static Pod Manifest File Access

Review the full command line (process.args, process.command_line), user.id, user.name, process.parent, and whether the
session was interactive. Confirm if the host is a Kubernetes node or admin jump host where manifest edits are expected.

### Possible investigation steps

- Compare activity to change windows and identity baselines; prioritize events without matching change tickets.
- Inspect subsequent process and file events on the same host for writes under /etc/kubernetes/manifests or kubelet
  restarts.
- Correlate with Kubernetes audit logs and node/agent telemetry for related compromise indicators.


### Response and remediation

- If unauthorized, restore manifests from known-good sources, isolate the host, and review cluster integrity per incident
  policy.


## Rule Query

```kuery
host.os.type:linux and event.category:process and event.action:(exec or executed) and 
process.name:(
  bash or sh or dash or zsh or 
  cat or cp or mv or touch or tee or dd or
  sed or awk or 
  curl or wget or scp or
  vi or vim or nano or echo or
  busybox or
  python* or perl* or ruby* or node or lua* or
  openssl or base64 or xxd or
  .*) and 
  process.args:(*/etc/kubernetes/manifests/* and not (/etc/kubernetes/manifests/etcd* or /etc/kubernetes/manifests/kube-apiserver* or /etc/kubernetes/manifests/kube-scheduler* or /etc/kubernetes/manifests/kube-controller-manager*)) and 
  not (process.args :printf* and process.working_directory :/home/*-svc-nessus) and 
  not process.parent.executable :("/opt/nessus/sbin/nessusd" or "/opt/nessus_agent/sbin/nessus-agent-module")
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Persistence
  - Id: TA0003
  - Reference URL: [[https://attack.mitre.org/tactics/TA0003/](https://attack.mitre.org/tactics/TA0003/)](https://attack.mitre.org/tactics/TA0003/)
- Technique:
  - Name: Scheduled Task/Job
  - Id: T1053
  - Reference URL: [[https://attack.mitre.org/techniques/T1053/](https://attack.mitre.org/techniques/T1053/)](https://attack.mitre.org/techniques/T1053/)
- Sub Technique:
  - Name: Container Orchestration Job
  - Id: T1053.007
  - Reference URL: [[https://attack.mitre.org/techniques/T1053/007/](https://attack.mitre.org/techniques/T1053/007/)](https://attack.mitre.org/techniques/T1053/007/)

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Privilege Escalation
  - Id: TA0004
  - Reference URL: [[https://attack.mitre.org/tactics/TA0004/](https://attack.mitre.org/tactics/TA0004/)](https://attack.mitre.org/tactics/TA0004/)
- Technique:
  - Name: Create or Modify System Process
  - Id: T1543
  - Reference URL: [[https://attack.mitre.org/techniques/T1543/](https://attack.mitre.org/techniques/T1543/)](https://attack.mitre.org/techniques/T1543/)
- Sub Technique:
  - Name: Container Service
  - Id: T1543.005
  - Reference URL: [[https://attack.mitre.org/techniques/T1543/005/](https://attack.mitre.org/techniques/T1543/005/)](https://attack.mitre.org/techniques/T1543/005/)