GPU Management Tool Run in Container

rule: GPU Management Tool Run in Container
desc: 'Detects execution of an NVIDIA or AMD GPU management or query tool, such as
  nvidia-smi or rocm-smi, inside a container. Attackers commonly run these tools immediately
  after gaining access to a GPU-equipped node to fingerprint the available accelerators
  before deploying a miner. Inside a workload container this is rarely legitimate
  outside of machine learning and HPC images. It is a signature-style detection that
  pairs with the device-access rule to provide both a behavioral and a signature view
  of the same accelerator-hijacking technique.

  '
condition: 'spawned_process and container and proc.name in (gpu_management_binaries)
  and not user_known_gpu_workloads

  '
enabled: false
output: GPU management tool run in container | evt_type=%evt.type user=%user.name
  user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath
  parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags
priority: CRITICAL
tags:
- maturity_sandbox
- container
- process
- mitre_impact
- T1496