Which SIEM platforms have a T1543.005 detection rule?

df00tech provides T1543.005 (Container Service) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Container Service (T1543.005)?

Detecting Container Service requires the following data sources: Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint (Linux).

What severity and confidence is the T1543.005 detection?

The T1543.005 detection is rated high severity with medium confidence.

What are common false positives for T1543.005?

Common false positives for T1543.005 include: Legitimate infrastructure-as-code pipelines (Ansible, Terraform, Puppet) deploying containers with specific restart policies in staging and production environments; Platform engineering teams running privileged containers for system-level tooling such as monitoring exporters (node-exporter, Falco), network packet capture tools, or kernel debuggers; Container security tooling (Falco, Sysdig, Tetragon) that require --privileged or specific capabilities to instrument the kernel.

T1543.005 IBM QRadar · QRadar

Detect Container Service in IBM QRadar

Adversaries may create or modify container or container cluster management tools that run as daemons, agents, or services on individual hosts. These include software for creating and managing individual containers, such as Docker and Podman, as well as container cluster node-level agents such as kubelet. By modifying these services, an adversary may achieve persistence or escalate their privileges on a host. Common abuse patterns include using 'docker run' or 'podman run' with the '--restart=always' directive to configure a container to persistently restart after daemon restarts or host reboots, using '--privileged', '--pid=host', or '--net=host' flags to break container isolation and gain access to the underlying host kernel, bind-mounting the root filesystem ('-v /:/') to read or modify host files, and leveraging Kubernetes DaemonSets to deploy malicious containers persistently across all current and future cluster nodes. Threat actor groups including TeamTNT have exploited exposed Docker APIs to deploy cryptomining and backdoor containers with restart=always policies. Privilege escalation via docker group membership is documented in GTFOBins and widely exploited in post-exploitation scenarios.

MITRE ATT&CK

Tactic: Persistence Privilege Escalation
Technique: T1543 Create or Modify System Process
Sub-technique: T1543.005 Container Service
Canonical reference: https://attack.mitre.org/techniques/T1543/005/

QRadar Detection Query

IBM QRadar (QRadar)

sql

SELECT
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  username,
  hostname,
  UTF8(payload) AS raw_payload,
  CASE
    WHEN UTF8(payload) ILIKE '%--restart=always%' OR UTF8(payload) ILIKE '%--restart always%' THEN 1
    ELSE 0
  END AS persistence_flag,
  CASE
    WHEN UTF8(payload) ILIKE '%--privileged%'
      OR UTF8(payload) ILIKE '%--pid=host%'
      OR UTF8(payload) ILIKE '%--net=host%'
      OR UTF8(payload) ILIKE '%--network=host%'
      OR UTF8(payload) ILIKE '%--cap-add=SYS_ADMIN%'
      OR UTF8(payload) ILIKE '%--cap-add SYS_ADMIN%'
      OR UTF8(payload) ILIKE '%--cap-add=ALL%'
      OR UTF8(payload) ILIKE '%--cap-add ALL%' THEN 1
    ELSE 0
  END AS privileged_flag,
  CASE
    WHEN UTF8(payload) ILIKE '%-v /%:/%'
      OR UTF8(payload) ILIKE '%--volume /%:/%'
      OR UTF8(payload) ILIKE '%--device /dev/mem%'
      OR UTF8(payload) ILIKE '%--device /dev/kmem%' THEN 1
    ELSE 0
  END AS host_mount_flag,
  CASE
    WHEN (UTF8(payload) ILIKE '%--restart=always%' OR UTF8(payload) ILIKE '%--restart always%')
      AND (UTF8(payload) ILIKE '%--privileged%' OR UTF8(payload) ILIKE '%--pid=host%' OR UTF8(payload) ILIKE '%--net=host%')
      THEN 'CRITICAL: Persistent privileged container'
    WHEN (UTF8(payload) ILIKE '%--restart=always%' OR UTF8(payload) ILIKE '%--restart always%')
      AND (UTF8(payload) ILIKE '%-v /%:/%' OR UTF8(payload) ILIKE '%--volume /%:/%')
      THEN 'CRITICAL: Persistent container with host filesystem mount'
    WHEN (UTF8(payload) ILIKE '%--privileged%' OR UTF8(payload) ILIKE '%--pid=host%')
      AND (UTF8(payload) ILIKE '%-v /%:/%' OR UTF8(payload) ILIKE '%--volume /%:/%')
      THEN 'HIGH: Privileged container with root filesystem access'
    WHEN UTF8(payload) ILIKE '%--restart=always%' OR UTF8(payload) ILIKE '%--restart always%'
      THEN 'MEDIUM: Container persistence via restart=always'
    WHEN UTF8(payload) ILIKE '%--privileged%' OR UTF8(payload) ILIKE '%--pid=host%'
      THEN 'HIGH: Privileged container or capability escalation'
    WHEN UTF8(payload) ILIKE '%-v /%:/%' OR UTF8(payload) ILIKE '%--volume /%:/%'
      THEN 'HIGH: Host root filesystem bind mount'
    ELSE 'MEDIUM: Suspicious container configuration'
  END AS attack_pattern
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Linux', 'LinuxAudit', 'SyslogNg', 'UniversalDSM')
  AND starttime > NOW() - 86400 SECONDS
  AND (
    (UTF8(payload) ILIKE '%docker run%' OR UTF8(payload) ILIKE '%podman run%' OR UTF8(payload) ILIKE '%nerdctl run%')
    AND (
      UTF8(payload) ILIKE '%--restart=always%' OR
      UTF8(payload) ILIKE '%--restart always%' OR
      UTF8(payload) ILIKE '%--privileged%' OR
      UTF8(payload) ILIKE '%--pid=host%' OR
      UTF8(payload) ILIKE '%--net=host%' OR
      UTF8(payload) ILIKE '%--network=host%' OR
      UTF8(payload) ILIKE '%--cap-add=SYS_ADMIN%' OR
      UTF8(payload) ILIKE '%--cap-add=ALL%' OR
      UTF8(payload) ILIKE '%-v /%:/%' OR
      UTF8(payload) ILIKE '%--device /dev/mem%' OR
      UTF8(payload) ILIKE '%--device /dev/kmem%'
    )
  )
  OR (
    (UTF8(payload) ILIKE '%docker exec%' OR UTF8(payload) ILIKE '%podman exec%')
    AND (UTF8(payload) ILIKE '%/bin/bash%' OR UTF8(payload) ILIKE '%/bin/sh%' OR UTF8(payload) ILIKE '% -i %' OR UTF8(payload) ILIKE '%sh -c%')
  )
ORDER BY starttime DESC
LIMIT 1000

high severity medium confidence

Detects T1543.005 container service abuse by analyzing Linux syslog and audit events for docker/podman/nerdctl run commands with persistence (--restart=always), privilege escalation (--privileged, --pid=host, --net=host, --cap-add), or host filesystem bind mount (-v /:/) flags. Also detects interactive shell exec into running containers.

Data Sources

Linux OS log source (syslog/auditd)QRadar Universal DSM for LinuxLinux Audit Framework via QRadar agent

Required Tables

events

False Positives & Tuning

Automated CI/CD pipeline agents (Jenkins, GitLab Runner) that use --privileged for Docker-in-Docker builds in dedicated build infrastructure
Container management platforms (Portainer, Rancher) that perform docker exec operations for legitimate container health checks and log collection
Infrastructure-as-code tools performing container lifecycle management with elevated flags in controlled deployment environments

Download portable Sigma rule (.yml)

Other platforms for T1543.005

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Docker Container Persistence via restart=always
Expected signal: Linux auditd EXECVE: type=EXECVE with a0=docker, a1=run, a2=-d, a3=--restart=always, a4=--name, a5=df00tech-persist-test. MDE DeviceProcessEvents: FileName=docker, ProcessCommandLine contains 'run' and '--restart=always'. Expected PersistenceFlag=true, PrivilegedFlag=false, HostMountFlag=false, RiskScore=1.
Test 2Privileged Container Execution with Host PID Namespace
Expected signal: Linux auditd EXECVE: type=EXECVE with args containing 'docker', 'run', '--privileged', '--pid=host'. MDE DeviceProcessEvents: ProcessCommandLine contains '--privileged' and '--pid=host'. PrivilegedFlag=true, RiskScore=1.
Test 3Container with Host Root Filesystem Bind Mount
Expected signal: Linux auditd EXECVE: args containing 'docker', 'run', '-v', '/:/host-root:ro'. MDE DeviceProcessEvents: ProcessCommandLine contains '-v /:/host-root'. HostMountFlag triggers on '-v /:/'. RiskScore=1.
Test 4Combined Persistent Privileged Container (Critical Combination)
Expected signal: Linux auditd EXECVE: args contain 'docker', 'run', '-d', '--restart=always', '--privileged', '--name', 'df00tech-critical-test'. MDE DeviceProcessEvents: ProcessCommandLine contains '--restart=always' and '--privileged'. PersistenceFlag=true, PrivilegedFlag=true, RiskScore=2.
Test 5Kubernetes DaemonSet Creation for Cluster-Wide Persistence
Expected signal: Kubernetes API server audit log: verb=create, objectRef.resource=daemonsets, objectRef.namespace=default, objectRef.name=df00tech-persist-daemonset, responseStatus.code=201. AzureDiagnostics Category=kube-audit or AKSAuditAdmin table: DaemonSet creation event with requesting user and full object spec.

Last updated: 2026-04-21 Research depth: deep

References (12)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1543.005 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Detect Container Service in IBM QRadar

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1543.005

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Persistence

Popular Detections

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1543.005

Testing Methodology

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Persistence

Popular Detections

Get new detections in your inbox