Samirbous 5b17d9d7ea [New] EKS Authentication Configuration Modified (#6090) ...

* [New] EKS Authentication Configuration Modified

Detects modifications to the aws-auth ConfigMap in Amazon EKS clusters. The aws-auth ConfigMap maps AWS IAM roles and users to Kubernetes RBAC groups, an attacker who modifies it can grant any IAM role cluster-admin access by adding a mapping to the system:masters group.

* Update rules/integrations/kubernetes/persistence_kubernetes_eks_aws_auth_configmap_modified.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

---------

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

(cherry picked from commit 7edfedbf10)

2026-05-14 15:31:39 +00:00

..

aws

[New] Diverse AWS rules (#5913)

2026-05-01 21:00:39 +00:00

aws_bedrock

[Tuning] Add mv_expand for gen_ai.policy.action field (#5296)

2025-11-11 07:37:40 +05:30

azure

Prep for Release 9.4 (#5965)

2026-04-22 18:46:33 +00:00

azure_openai

[Rule Tuning] Updated ESQL Rules Based on Validation Results (#5151)

2025-09-30 00:36:29 -04:00

beaconing

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:16:50 +00:00

cloud_defend

[New] Container Runtime CLI Execution with Suspicious Arguments (#6009)

2026-05-05 21:54:10 +00:00

cyberarkpas

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:31:57 +00:00

ded

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:16:50 +00:00

dga

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:16:50 +00:00

endpoint

Prep 8.19/9.1 (#4869)

2025-07-07 11:27:48 -04:00

fim

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:31:57 +00:00

gcp

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:31:57 +00:00

github

Field not supported in integration (#6131)

2026-05-13 12:23:52 +00:00

google_workspace

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:31:57 +00:00

kubernetes

[New] EKS Authentication Configuration Modified (#6090)

2026-05-14 15:31:39 +00:00

lmd

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:16:50 +00:00

microsoft_exchange_online_message_trace

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:31:57 +00:00

o365

[Rule Tuning] M365 Atypical / Impossible Travel (geo field reliability + ApplicationId exclusion parity) (#6093)

2026-05-07 12:04:51 +00:00

okta

[Rule Tuning] Revert Event Dataset for Security Alert Index (#5994)

2026-04-28 17:20:23 +00:00

pad

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:16:50 +00:00

problemchild

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:16:50 +00:00