admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

k8s scanner

Browse Source
This commit is contained in:
P4T12ICK
2021-08-25 17:09:38 +02:00
parent 38e69f6dab cfa735bde4
commit 386a45237b
1 changed files with 11 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/kubernetes_scanner_image_pulling.yml
+11 -8
View File
@@ -5,14 +5,13 @@ date: '2021-08-24'
author: Patrick Bareiss, Splunk
type: TTP
datamodel: []
description: This search uses the Kubernetes logs from Splunk Connect from Kubernetes to
detect Kubernetes Security Scanner.
search: '`kube_objects_events` object.message IN ("Pulling image *kube-hunter*", "Pulling image *kube-bench*", "Pulling image *kube-recon*", "Pulling image *kube-recon*")
| rename object.* AS *
| rename involvedObject.* AS *
| rename source.host AS host
| stats min(_time) as firstTime max(_time) as lastTime count by host, name, namespace, kind, reason, message
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
description: This search uses the Kubernetes logs from Splunk Connect from Kubernetes
to detect Kubernetes Security Scanner.
search: '`kube_objects_events` object.message IN ("Pulling image *kube-hunter*", "Pulling
image *kube-bench*", "Pulling image *kube-recon*", "Pulling image *kube-recon*")
| rename object.* AS * | rename involvedObject.* AS * | rename source.host AS host
| stats min(_time) as firstTime max(_time) as lastTime count by host, name, namespace,
kind, reason, message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `kubernetes_scanner_image_pulling_filter`'
how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
known_false_positives: unknown
@@ -52,3 +51,7 @@ tags:
- object.reason
risk_score: 49
security_domain: network
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1526/kubernetes_kube_hunter/kubernetes_kube_hunter.json