From cfa735bde414b4c8536113faf2b8999887ebdbb3 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 25 Aug 2021 09:10:24 +0000 Subject: [PATCH] Added detection testing service results inKubernetes Scanner Image Pulling --- .../kubernetes_scanner_image_pulling.yml | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/detections/cloud/kubernetes_scanner_image_pulling.yml b/detections/cloud/kubernetes_scanner_image_pulling.yml index b3229a8415..5346d484af 100644 --- a/detections/cloud/kubernetes_scanner_image_pulling.yml +++ b/detections/cloud/kubernetes_scanner_image_pulling.yml @@ -5,14 +5,13 @@ date: '2021-08-24' author: Patrick Bareiss, Splunk type: TTP datamodel: [] -description: This search uses the Kubernetes logs from Splunk Connect from Kubernetes to - detect Kubernetes Security Scanner. -search: '`kube_objects_events` object.message IN ("Pulling image *kube-hunter*", "Pulling image *kube-bench*", "Pulling image *kube-recon*", "Pulling image *kube-recon*") - | rename object.* AS * - | rename involvedObject.* AS * - | rename source.host AS host - | stats min(_time) as firstTime max(_time) as lastTime count by host, name, namespace, kind, reason, message - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +description: This search uses the Kubernetes logs from Splunk Connect from Kubernetes + to detect Kubernetes Security Scanner. +search: '`kube_objects_events` object.message IN ("Pulling image *kube-hunter*", "Pulling + image *kube-bench*", "Pulling image *kube-recon*", "Pulling image *kube-recon*") + | rename object.* AS * | rename involvedObject.* AS * | rename source.host AS host + | stats min(_time) as firstTime max(_time) as lastTime count by host, name, namespace, + kind, reason, message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kubernetes_scanner_image_pulling_filter`' how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes. known_false_positives: unknown @@ -52,4 +51,6 @@ tags: - object.reason risk_score: 49 security_domain: network - + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1526/kubernetes_kube_hunter/kubernetes_kube_hunter.json