Skip to content

Commit 0d63f52

Browse files
LArippingnasbench
LAripping
and
nasbench
authored
Merge PR #4694 from @LAripping - Add native Kubernetes detections
new: Container With A hostPath Mount Created new: Creation Of Pod In System Namespace new: Deployment Deleted From Kubernetes Cluster new: Kubernetes Events Deleted new: Kubernetes Secrets Enumeration new: New Kubernetes Service Account Created new: Potential Remote Command Execution In Pod Container new: Potential Sidecar Injection Into Running Deployment new: Privileged Container Deployed new: RBAC Permission Enumeration Attempt --------- Co-authored-by: nasbench <[email protected]>
1 parent 16d8345 commit 0d63f52

11 files changed

+275
-0
lines changed

‎rules/application/kubernetes/audit/kubernetes_audit_deployment_deleted.yml

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
title: Deployment Deleted From Kubernetes Cluster
2+
id: 40967487-139b-4811-81d9-c9767a92aa5a
3+
status: experimental
4+
description: |
5+
Detects the removal of a deployment from a Kubernetes cluster.
6+
This could indicate disruptive activity aiming to impact business operations.
7+
references:
8+
- https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Data%20destruction/
9+
author: Leo Tsaousis (@laripping)
10+
date: 2024/03/26
11+
tags:
12+
- attack.t1498
13+
logsource:
14+
category: application
15+
product: kubernetes
16+
service: audit
17+
detection:
18+
selection:
19+
verb: 'delete'
20+
objectRef.resource: 'deployments'
21+
condition: selection
22+
falsepositives:
23+
- Unknown
24+
level: low

‎rules/application/kubernetes/audit/kubernetes_audit_events_deleted.yml

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
title: Kubernetes Events Deleted
2+
id: 3132570d-cab2-4561-9ea6-1743644b2290
3+
related:
4+
- id: 225d8b09-e714-479c-a0e4-55e6f29adf35
5+
type: derived
6+
status: experimental
7+
description: |
8+
Detects when events are deleted in Kubernetes.
9+
An adversary may delete Kubernetes events in an attempt to evade detection.
10+
references:
11+
- https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Delete%20K8S%20events/
12+
author: Leo Tsaousis (@laripping)
13+
date: 2024/03/26
14+
tags:
15+
- attack.t1070
16+
logsource:
17+
category: application
18+
product: kubernetes
19+
service: audit
20+
detection:
21+
selection:
22+
verb: 'delete'
23+
objectRef.resource: 'events'
24+
condition: selection
25+
falsepositives:
26+
- Unknown
27+
level: medium

‎rules/application/kubernetes/audit/kubernetes_audit_exec_into_container.yml

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
title: Potential Remote Command Execution In Pod Container
2+
id: a1b0ca4e-7835-413e-8471-3ff2b8a66be6
3+
status: experimental
4+
description: |
5+
Detects attempts to execute remote commands, within a Pod's container using e.g. the "kubectl exec" command.
6+
references:
7+
- https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Exec%20into%20container/
8+
author: Leo Tsaousis (@laripping)
9+
date: 2024/03/26
10+
tags:
11+
- attack.t1609
12+
logsource:
13+
category: application
14+
product: kubernetes
15+
service: audit
16+
detection:
17+
selection:
18+
verb: 'create'
19+
objectRef.resource: 'pods'
20+
objectRef.subresource: 'exec'
21+
condition: selection
22+
falsepositives:
23+
- Legitimate debugging activity. Investigate the identity performing the requests and their authorization.
24+
level: medium

‎rules/application/kubernetes/audit/kubernetes_audit_hostpath_mount.yml

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
title: Container With A hostPath Mount Created
2+
id: 402b955c-8fe0-4a8c-b635-622b4ac5f902
3+
status: experimental
4+
description: |
5+
Detects creation of a container with a hostPath mount.
6+
A hostPath volume mounts a directory or a file from the node to the container.
7+
Attackers who have permissions to create a new pod in the cluster may create one with a writable hostPath volume and chroot to escape to the underlying node.
8+
references:
9+
- https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Writable%20hostPath%20mount/
10+
- https://blog.appsecco.com/kubernetes-namespace-breakout-using-insecure-host-path-volume-part-1-b382f2a6e216
11+
author: Leo Tsaousis (@laripping)
12+
date: 2024/03/26
13+
tags:
14+
- attack.t1611
15+
logsource:
16+
category: application
17+
product: kubernetes
18+
service: audit
19+
detection:
20+
selection:
21+
verb: 'create'
22+
objectRef.resource: 'pods'
23+
hostPath: '*' # Note: Add the "exists" when it's implemented in SigmaHQ/Aurora
24+
condition: selection
25+
falsepositives:
26+
- The DaemonSet controller creates pods with hostPath volumes within the kube-system namespace.
27+
level: low

‎rules/application/kubernetes/audit/kubernetes_audit_pod_in_system_namespace.yml

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
title: Creation Of Pod In System Namespace
2+
id: a80d927d-ac6e-443f-a867-e8d6e3897318
3+
status: experimental
4+
description: |
5+
Detects deployments of pods within the kube-system namespace, which could be intended to imitate system pods.
6+
System pods, created by controllers such as Deployments or DaemonSets have random suffixes in their names.
7+
Attackers can use this fact and name their backdoor pods as if they were created by these controllers to avoid detection.
8+
Deployment of such a backdoor container e.g. named kube-proxy-bv61v, could be attempted in the kube-system namespace alongside the other administrative containers.
9+
references:
10+
- https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Pod%20or%20container%20name%20similarily/
11+
author: Leo Tsaousis (@laripping)
12+
date: 2024/03/26
13+
tags:
14+
- attack.t1036.005
15+
logsource:
16+
category: application
17+
product: kubernetes
18+
service: audit
19+
detection:
20+
selection:
21+
verb: 'create'
22+
objectRef.resource: 'pods'
23+
objectRef.namespace: kube-system
24+
condition: selection
25+
falsepositives:
26+
- System components such as daemon-set-controller and kube-scheduler also create pods in the kube-system namespace
27+
level: medium

‎rules/application/kubernetes/audit/kubernetes_audit_privileged_pod_creation.yml

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
title: Privileged Container Deployed
2+
id: c5cd1b20-36bb-488d-8c05-486be3d0cb97
3+
status: experimental
4+
description: |
5+
Detects the creation of a "privileged" container, an action which could be indicative of a threat actor mounting a container breakout attacks.
6+
A privileged container is a container that can access the host with all of the root capabilities of the host machine. This allows it to view, interact and modify processes, network operations, IPC calls, the file system, mount points, SELinux configurations etc. as the root user on the host.
7+
Various versions of "privileged" containers can be specified, e.g. by setting the securityContext.privileged flag in the resource specification, setting non-standard Linux capabilities, or configuring the hostNetwork/hostPID fields
8+
references:
9+
- https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Privileged%20container/
10+
- https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-kubernetes.html#privilegeescalation-kubernetes-privilegedcontainer
11+
- https://www.elastic.co/guide/en/security/current/kubernetes-pod-created-with-hostnetwork.html
12+
- https://www.elastic.co/guide/en/security/current/kubernetes-container-created-with-excessive-linux-capabilities.html
13+
author: Leo Tsaousis (@laripping)
14+
date: 2024/03/26
15+
tags:
16+
- attack.t1611
17+
logsource:
18+
category: application
19+
product: kubernetes
20+
service: audit
21+
detection:
22+
selection:
23+
verb: 'create'
24+
objectRef.resource: 'pods'
25+
capabilities: '*' # Note: Add the "exists" when it's implemented in SigmaHQ/Aurora
26+
condition: selection
27+
falsepositives:
28+
- Unknown
29+
level: low

‎rules/application/kubernetes/audit/kubernetes_audit_rbac_permisions_listing.yml

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
title: RBAC Permission Enumeration Attempt
2+
id: 84b777bd-c946-4d17-aa2e-c39f5a454325
3+
status: experimental
4+
description: |
5+
Detects identities attempting to enumerate their Kubernetes RBAC permissions.
6+
In the early stages of a breach, attackers will aim to list the permissions they have within the compromised environment.
7+
In a Kubernetes cluster, this can be achieved by interacting with the API server, and querying the SelfSubjectAccessReview API via e.g. a "kubectl auth can-i --list" command.
8+
This will enumerate the Role-Based Access Controls (RBAC) rules defining the compromised user's authorization.
9+
references:
10+
- https://www.elastic.co/guide/en/security/current/kubernetes-suspicious-self-subject-review.html
11+
author: Leo Tsaousis (@laripping)
12+
date: 2024/03/26
13+
tags:
14+
- attack.t1069.003
15+
- attack.t1087.004
16+
logsource:
17+
category: application
18+
product: kubernetes
19+
service: audit
20+
detection:
21+
selection:
22+
verb: 'create'
23+
apiGroup: 'authorization.k8s.io'
24+
objectRef.resource: 'selfsubjectrulesreviews'
25+
condition: selection
26+
falsepositives:
27+
- Unknown
28+
level: low

‎rules/application/kubernetes/audit/kubernetes_audit_secrets_enumeration.yml

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
title: Kubernetes Secrets Enumeration
2+
id: eeb3e9e1-b685-44e4-9232-6bb701f925b5
3+
related:
4+
- id: 7ee0b4aa-d8d4-4088-b661-20efdf41a04c
5+
type: derived
6+
status: experimental
7+
description: Detects enumeration of Kubernetes secrets.
8+
references:
9+
- https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/List%20K8S%20secrets/
10+
author: Leo Tsaousis (@laripping)
11+
date: 2024/03/26
12+
tags:
13+
- attack.t1552.007
14+
logsource:
15+
category: application
16+
product: kubernetes
17+
service: audit
18+
detection:
19+
selection:
20+
verb: 'list'
21+
objectRef.resource: 'secrets'
22+
condition: selection
23+
falsepositives:
24+
- The Kubernetes dashboard occasionally accesses the kubernetes-dashboard-key-holder secret
25+
level: low

‎rules/application/kubernetes/audit/kubernetes_audit_serviceaccount_creation.yml

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
title: New Kubernetes Service Account Created
2+
id: e31bae15-83ed-473e-bf31-faf4f8a17d36
3+
related:
4+
- id: 12d027c3-b48c-4d9d-8bb6-a732200034b2
5+
type: derived
6+
status: experimental
7+
description: |
8+
Detects creation of new Kubernetes service account, which could indicate an attacker's attempt to persist within a cluster.
9+
references:
10+
- https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/container%20service%20account/
11+
author: Leo Tsaousis (@laripping)
12+
date: 2024/03/26
13+
tags:
14+
- attack.t1136
15+
logsource:
16+
category: application
17+
product: kubernetes
18+
service: audit
19+
detection:
20+
selection:
21+
verb: 'create'
22+
objectRef.resource: 'serviceaccounts'
23+
condition: selection
24+
falsepositives:
25+
- Unknown
26+
level: low

‎rules/application/kubernetes/audit/kubernetes_audit_sidecar_injection.yml

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
title: Potential Sidecar Injection Into Running Deployment
2+
id: ad9012a6-e518-4432-9890-f3b82b8fc71f
3+
status: experimental
4+
description: |
5+
Detects attempts to inject a sidecar container into a running deployment.
6+
A sidecar container is an additional container within a pod, that resides alongside the main container.
7+
One way to add containers to running resources like Deployments/DeamonSets/StatefulSets, is via a "kubectl patch" operation.
8+
By injecting a new container within a legitimate pod, an attacker can run their code and hide their activity, instead of running their own separated pod in the cluster.
9+
references:
10+
- https://kubernetes.io/docs/tasks/manage-kubernetes-objects/update-api-object-kubectl-patch
11+
- https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Sidecar%20Injection/
12+
author: Leo Tsaousis (@laripping)
13+
date: 2024/03/26
14+
tags:
15+
- attack.t1609
16+
logsource:
17+
category: application
18+
product: kubernetes
19+
service: audit
20+
detection:
21+
selection:
22+
verb: 'patch'
23+
apiGroup: 'apps'
24+
objectRef.resource: 'deployments'
25+
condition: selection
26+
falsepositives:
27+
- Unknown
28+
level: medium

‎tests/logsource.json

+10
Original file line numberDiff line numberDiff line change
@@ -194,6 +194,16 @@
194194
},
195195
"service":{}
196196
},
197+
"kubernetes":{
198+
"commun": [],
199+
"empty": [],
200+
"category":{
201+
"application":[]
202+
},
203+
"service":{
204+
"audit": []
205+
}
206+
},
197207
"python":{
198208
"commun": [],
199209
"empty": [],

0 commit comments

Comments
 (0)