Skip to content

Commit 726b7d2

Browse files
Tejas-24ytjTejas-24ytj
authored
Refined vm policies, fix tags for vm policies and capitalize tags for cluster policy. (#1075)
1 parent 0cf6103 commit 726b7d2

34 files changed

+931
-598
lines changed

‎generic/csp/audit-network-packet-tools.yaml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
apiVersion: security.kubearmor.com/v1
2+
kind: KubeArmorClusterPolicy
3+
metadata:
4+
name: audit-network-packet-tools
5+
annotations:
6+
app.accuknox.com/type: harden
7+
spec:
8+
action: Audit
9+
severity: 3
10+
message: "Detected use of network packet manipulation tool"
11+
process:
12+
matchPaths:
13+
- execname: iptables
14+
- execname: ip6tables
15+
- execname: nft
16+
- execname: nftables
17+
- execname: ip
18+
- execname: iproute2
19+
- execname: tc
20+
- execname: brctl
21+
- execname: arp
22+
- execname: arptables
23+
- execname: ebtables
24+
- execname: ethtool
25+
selector:
26+
matchExpressions:
27+
- key: namespace
28+
operator: NotIn
29+
values:
30+
- kube-system # exempt system namespace
31+
tags:
32+
- MITRE
33+
- MITRE_T1562_IMPAIR_DEFENSE

‎generic/csp/audit-pen-test-recon-tools.yaml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
apiVersion: security.kubearmor.com/v1
2+
kind: KubeArmorClusterPolicy
3+
metadata:
4+
name: audit-pen-test-recon-tools
5+
annotations:
6+
app.accuknox.com/type: harden
7+
spec:
8+
action: Block
9+
severity: 3
10+
message: "Blocked Reconnaissance or Penetration Testing tool execution"
11+
selector:
12+
matchExpressions:
13+
- key: namespace
14+
operator: NotIn
15+
values:
16+
- kube-system
17+
process:
18+
matchPaths:
19+
# Recon & Network Scanners
20+
- execname: nmap
21+
- execname: masscan
22+
- execname: zmap
23+
24+
# Password / Hash Crackers
25+
- execname: hydra
26+
- execname: john
27+
- execname: hashcat
28+
- execname: medusa
29+
- execname: patator
30+
tags:
31+
- MITRE
32+
- MITRE_T1046_NETWORK_SERVICE_SCANNING
33+
- MITRE_T1110_BRUTE_FORCE

‎generic/csp/audit-temp-usage.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
apiVersion: security.kubearmor.com/v1
2+
kind: KubeArmorClusterPolicy
3+
metadata:
4+
annotations:
5+
app.accuknox.com/type: harden
6+
name: audit-tmp-usage
7+
spec:
8+
action: Audit
9+
severity: 3
10+
message: "Detected /tmp directory access"
11+
file:
12+
matchDirectories:
13+
- dir: /tmp/
14+
recursive: true
15+
selector:
16+
matchExpressions:
17+
- key: namespace
18+
operator: NotIn
19+
values:
20+
- kube-system
21+
tags:
22+
- CIS
23+
- CIS_CM
24+
- MITRE
25+
- MITRE_T1074_DATA_STAGED

‎generic/csp/cronjob-cfg.yaml‎

Lines changed: 37 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1,39 +1,48 @@
11
apiVersion: security.kubearmor.com/v1
22
kind: KubeArmorClusterPolicy
33
metadata:
4+
annotations:
5+
app.accuknox.com/type: harden
46
name: cronjob-cfg
57
spec:
68
action: Audit
9+
severity: 5
10+
message: "Detected access to cron job files/directories"
711
file:
812
matchDirectories:
9-
- dir: /etc/cron.d/
10-
recursive: true
11-
- dir: /etc/cron.daily/
12-
recursive: true
13-
- dir: /etc/cron.hourly/
14-
recursive: true
15-
- dir: /etc/cron.monthly/
16-
recursive: true
17-
- dir: /etc/cron.weekly/
18-
recursive: true
19-
- dir: /var/cron/
20-
recursive: true
21-
- dir: /var/spool/cron/
22-
recursive: true
23-
matchPaths:
24-
- path: /etc/crontab
25-
message: Alert! Access to cron job files/directories detected.
13+
- dir: /etc/cron.d/
14+
recursive: true
15+
- dir: /etc/cron.daily/
16+
recursive: true
17+
- dir: /etc/cron.hourly/
18+
recursive: true
19+
- dir: /etc/cron.monthly/
20+
recursive: true
21+
- dir: /etc/cron.weekly/
22+
recursive: true
23+
- dir: /var/cron/
24+
recursive: true
25+
- dir: /var/spool/cron/
26+
recursive: true
27+
matchPaths:
28+
- path: /etc/crontab
29+
readOnly: true
30+
- path: /etc/anacrontab # Runs scheduled tasks (cron jobs) that were missed while the system was off.
31+
readOnly: true
32+
- path: /etc/cron.allow
33+
readOnly: true
34+
- path: /etc/cron.deny
35+
readOnly: true
2636
selector:
2737
matchExpressions:
28-
- key: namespace
29-
operator: NotIn
30-
values:
31-
- kube-system
32-
severity: 5
38+
- key: namespace
39+
operator: NotIn
40+
values:
41+
- kube-system
3342
tags:
34-
- CIS
35-
- CIS_5.1_Configure_Cron
36-
- CIS_Linux
37-
- NIST
38-
- NIST_800-53_SI-4
39-
- SI-4
43+
- CIS
44+
- CIS_5.1_CONFIGURE_CRON
45+
- CIS_LINUX
46+
- NIST
47+
- NIST_800-53_SI-4
48+
- SI-4

‎generic/csp/crypto-miners.yaml‎

Lines changed: 26 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,34 +1,35 @@
11
apiVersion: security.kubearmor.com/v1
22
kind: KubeArmorClusterPolicy
33
metadata:
4+
annotations:
5+
app.accuknox.com/type: harden
46
name: crypto-miners
57
spec:
68
action: Block
7-
message: cryptominer detected and blocked
8-
process:
9-
matchDirectories:
10-
- dir: /tmp/
11-
recursive: true
12-
matchPaths:
13-
- execname: apk
14-
- execname: apt
15-
- execname: dero-miner-linux-amd64
16-
- execname: dero-wallet-cli-linux-amd64
17-
- execname: dero
18-
- execname: derod-linux-amd64
19-
- execname: masscan
20-
- execname: nmap
21-
- execname: ntpdate
22-
- execname: xmrig
23-
- execname: zgrab2
9+
severity: 3
10+
message: "Blocked Cryptominer"
2411
selector:
2512
matchExpressions:
26-
- key: namespace
27-
operator: NotIn
28-
values:
29-
- kube-system
30-
severity: 10
13+
- key: namespace
14+
operator: NotIn
15+
values:
16+
- kube-system
17+
process:
18+
matchPaths:
19+
# DERO cryptominers
20+
- execname: dero-miner-linux-amd64
21+
- execname: dero-wallet-cli-linux-amd64
22+
- execname: dero
23+
- execname: derod-linux-amd64
24+
25+
# Monero CPU/GPU miners
26+
- execname: xmrig
27+
- execname: xmrig-stak
28+
- execname: minerd
29+
- execname: mminerd
30+
- execname: cpuminer
31+
- execname: sgminer
32+
- execname: ccminer
3133
tags:
32-
- MITRE
33-
- MITRE_T1496_resource_hijacking
34-
- cryptominer
34+
- MITRE
35+
- MITRE_T1496_RESOURCE_HIJACKING

‎generic/csp/external-devices-connected.yaml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
apiVersion: security.kubearmor.com/v1
2+
kind: KubeArmorClusterPolicy
3+
metadata:
4+
name: audit-external-device
5+
annotations:
6+
app.accuknox.com/type: harden
7+
spec:
8+
action: Audit
9+
severity: 3
10+
message: "Detected modification of external device access"
11+
selector:
12+
matchExpressions:
13+
- key: namespace
14+
operator: NotIn
15+
values:
16+
- kube-system
17+
process:
18+
matchPaths:
19+
- execname: mount
20+
- execname: umount
21+
- execname: fdisk
22+
- execname: cfdisk
23+
- execname: sfdisk
24+
- execname: parted
25+
- execname: mkfs
26+
- execname: fsck
27+
- execname: lsblk
28+
- execname: blkid
29+
- execname: losetup
30+
- execname: kpartx
31+
- execname: qemu-nbd
32+
- execname: mountpoint
33+
tags:
34+
- MITRE
35+
- MITRE_T1091_REPLICATION_THROUGH_REMOVABLE_MEDIA

‎generic/csp/file-integrity-monitoring.yaml‎

Lines changed: 29 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -1,41 +1,40 @@
11
apiVersion: security.kubearmor.com/v1
22
kind: KubeArmorClusterPolicy
33
metadata:
4+
annotations:
5+
app.accuknox.com/type: harden
46
name: file-integrity-monitoring
57
spec:
6-
action: Block
8+
action: Audit
9+
message: "Detected attempted modification of core system binary/library directories (file integrity)"
710
file:
811
matchDirectories:
9-
- dir: /bin/
10-
readOnly: true
11-
recursive: true
12-
- dir: /boot/
13-
readOnly: true
14-
recursive: true
15-
- dir: /sbin/
16-
readOnly: true
17-
recursive: true
18-
- dir: /usr/bin/
19-
readOnly: true
20-
recursive: true
21-
- dir: /usr/lib/
22-
readOnly: true
23-
recursive: true
24-
- dir: /usr/sbin/
25-
readOnly: true
26-
recursive: true
27-
message: Detected and prevented compromise to File integrity
12+
- dir: /bin/
13+
recursive: true
14+
readOnly: true
15+
- dir: /sbin/
16+
recursive: true
17+
readOnly: true
18+
- dir: /usr/bin/
19+
recursive: true
20+
readOnly: true
21+
- dir: /usr/sbin/
22+
recursive: true
23+
readOnly: true
24+
- dir: /boot/
25+
recursive: true
26+
readOnly: true
2827
selector:
2928
matchExpressions:
30-
- key: namespace
31-
operator: NotIn
32-
values:
33-
- kube-system
29+
- key: namespace
30+
operator: NotIn
31+
values:
32+
- kube-system
3433
severity: 1
3534
tags:
36-
- MITRE
37-
- MITRE_T1036_masquerading
38-
- MITRE_T1565_data_manipulation
39-
- NIST
40-
- NIST_800-53_AU-2
41-
- NIST_800-53_SI-4
35+
- MITRE
36+
- MITRE_T1036_MASQUERADING
37+
- MITRE_T1565_DATA_MANIPULATION
38+
- NIST
39+
- NIST_800-53_AU-2
40+
- NIST_800-53_SI

‎generic/csp/impair-defense.yaml‎

Lines changed: 18 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -2,25 +2,29 @@ apiVersion: security.kubearmor.com/v1
22
kind: KubeArmorClusterPolicy
33
metadata:
44
name: impair-defense
5+
annotations:
6+
app.accuknox.com/type: harden
57
spec:
6-
action: Audit
8+
action: Block
79
file:
810
matchDirectories:
9-
- dir: /etc/apparmor.d/
10-
recursive: true
11-
- dir: /etc/sysconfig/selinux/
12-
recursive: true
11+
- dir: /etc/apparmor.d/
12+
recursive: true
13+
readOnly: true
14+
- dir: /etc/sysconfig/selinux/
15+
recursive: true
16+
readOnly: true
1317
matchPaths:
14-
- path: /etc/selinux/semanage.conf
15-
message: Selinux Files Accessed by Unknown Process
18+
- path: /etc/selinux/semanage.conf
19+
readOnly: true
20+
message: "Detected unauthorized attempt to modify SELinux/AppArmor policy files"
1621
selector:
1722
matchExpressions:
18-
- key: namespace
19-
operator: NotIn
20-
values:
21-
- kube-system
23+
- key: namespace
24+
operator: NotIn
25+
values:
26+
- kubearmor
27+
- agents
2228
severity: 6
2329
tags:
24-
- FGT1562
25-
- FIGHT
26-
- MITRE
30+
- FGT1562

0 commit comments

Comments
 (0)