✄𐘗
text code block:
✄𐘗FROM logs-azure.platformlogs-* METADATA _id, _index, _version
| WHERE data_stream.dataset == "azure.platformlogs"
    AND event.action == "Microsoft.ContainerService/managedClusters/diagnosticLogs/Read"
    AND azure.platformlogs.category == "kube-audit"
| EVAL Esql.stage = FIELD_EXTRACT(azure.platformlogs.properties, "log.stage"),
    Esql.resource = FIELD_EXTRACT(azure.platformlogs.properties, "log.objectRef.resource"),
    Esql.subresource = FIELD_EXTRACT(azure.platformlogs.properties, "log.objectRef.subresource"),
    Esql.verb = FIELD_EXTRACT(azure.platformlogs.properties, "log.verb"),
    Esql.requestURI = FIELD_EXTRACT(azure.platformlogs.properties, "log.requestURI"),
    Esql.namespace = FIELD_EXTRACT(azure.platformlogs.properties, "log.objectRef.namespace"),
    Esql.pod_name = FIELD_EXTRACT(azure.platformlogs.properties, "log.objectRef.name"),
    Esql.username = FIELD_EXTRACT(azure.platformlogs.properties, "log.user.username"),
    Esql.user_agent = FIELD_EXTRACT(azure.platformlogs.properties, "log.userAgent"),
    Esql.source_ips = FIELD_EXTRACT(azure.platformlogs.properties, "log.sourceIPs"),
    Esql.response_code = FIELD_EXTRACT(azure.platformlogs.properties, "log.responseStatus.code")
| WHERE Esql.stage == "ResponseComplete"
    AND Esql.resource == "pods"
    AND Esql.subresource == "exec"
    AND Esql.verb IN ("create", "get")
    AND Esql.requestURI LIKE "*command=*"
    AND Esql.response_code == "101"
    AND Esql.username IS NOT NULL
    AND NOT Esql.username RLIKE "system:node:.*|system:serviceaccount:kube-system:.*"
    AND NOT Esql.username IN ("aksService", "hcpService", "readinessChecker", "system:apiserver", "system:kube-controller-manager", "system:kube-scheduler")
| EVAL Esql.executed_command = TRIM(REPLACE(REPLACE(REPLACE(
    URL_DECODE(Esql.requestURI),
    """^[^?]*\?""", ""),
    """&?(container|stderr|stdin|stdout|tty)=[^&]*""", ""),
    """&?command=""", " "))
| WHERE Esql.executed_command IS NOT NULL
    // Split across several RLIKE clauses by tool family: a single combined pattern
    // exceeds the Lucene regex determinization limit and is rejected at parse time.
    AND (
        Esql.executed_command RLIKE """.*(/dev/tcp/|/dev/udp/|/inet/tcp/|/inet/udp/|zsh/net/tcp|zsh/net/udp|ztcp\s|(\s|/)(ba|da|a|z|k|c|tc|mk|fi|tcl)?sh\s+-(i|il|li)|nc\s+-e|ncat\s+-e|netcat\s+-e|\s-e\s+/(usr/)?bin/[a-z]*sh|\s-c\s+/(usr/)?bin/[a-z]*sh|(nc|ncat|netcat)[a-z.]*\s+--(sh-)?exec|busybox\s+(nc|netcat|ncat)\s|mkfifo|mknod\s+/(tmp|var/tmp|dev/shm|run)/).*"""
        OR Esql.executed_command RLIKE """(ba|da|a|z|k|c|tc|mk|fi|tcl)?sh\s+-(i|il|li).*"""
        OR Esql.executed_command RLIKE """.*socat[0-9]?\s.*((EXEC|Exec|exec|SYSTEM|System|system):|(PTY|Pty|pty)|(OPENSSL|Openssl|openssl)|(UDP|Udp|udp)[0-9]?[-:]|(TCP|Tcp|tcp)-?(LISTEN|Listen|listen)).*"""
        OR Esql.executed_command RLIKE """.*(socket\.create_connection\(|pty\.spawn\(|subprocess\.call\(|os\.dup2\(|Socket::INET|sockaddr_in\(|TCPSocket\.(new|open)|TCPServer\.new|ruby[0-9.]*\s+-rsocket|fsockopen|stream_socket_client\(|socket_connect\(|socket\.tcp\(|net\.(connect|createConnection|createServer)\(|openssl\s+s_server|stty\s+raw\s+-echo|gs-netcat|gs-sftp|gs-mount|gs-full-pipe|GSOCKET_ARGS=|GS_ARGS=|GS_NOINST=).*"""
        OR Esql.executed_command RLIKE """.*(import\s+socket.*connect|socket\.socket.*connect|import\s+pty.*spawn|nc\s.*\s-c\s).*"""
        OR Esql.executed_command RLIKE """.*(php[0-9.]*\s+-r.*(proc_open|pcntl_exec|shell_exec|passthru)\(|lua[0-9.]*\s+-e.*(io\.popen|os\.execute)).*"""
        OR Esql.executed_command RLIKE """.*((vim|rvim|vimdiff|view|rview)\s+-c.*socket|xterm\s+-display\s+[0-9]).*"""
    )
    AND NOT Esql.executed_command RLIKE """.*/dev/tcp/(localhost|127\.0\.0\.1)/(8080|8443|9090|3000|5000|8888|80|443).*"""
    AND NOT Esql.executed_command RLIKE """.*socat.*(UNIX-CONNECT|UNIX-LISTEN).*"""
| KEEP Esql.*, event.action, data_stream.namespace, _id, _index, _version