RBACAWSsearch

detections/kubernetes_aws_detect_RBAC_authorizations_by_account.yml

@@ -0,0 +1,18 @@
+author: "Rod Soto, Splunk"
+date: "2020-06-23"
+description: "This search provides information on Kubernetes RBAC authorizations by accounts, this search can be modified by adding top to see both extremes of RBAC by accounts occurrences"
+how_to_implement: "You must install splunk AWS add on and Splunk App for AWS. This search works with cloudwatch logs"
+id: de7264ed-3ed9-4fef-bb01-6eefc87cefe8
+known_false_positives: "Not all RBAC Authorications are malicious. RBAC authorizations can uncover malicious activity specially if sensitive Roles have been granted."
+name: "AWS EKS Kubernetes RBAC authorizations by account"
+references: []
+search: sourcetype="aws:cloudwatchlogs:eks" annotations.authorization.k8s.io/reason=* | table sourceIPs{} user.username userAgent annotations.authorization.k8s.io/reason | stats count by user.username annotations.authorization.k8s.io/reason | rare user.username annotations.authorization.k8s.io/reason |`kubernetes_aws_detect_RBAC_authorization_by_account`
+tags:
+  analytics_story:
+    - "Kubernetes Sensitive Role Activity"
+  asset_type: "AWS EKS Kubernetes cluster"
+  kill_chain_phases:
+    - Lateral Movement
+  security_domain: threat
+type: ESCU
+version: 1

macros/kubernetes_aws_detect_RBAC_authorization_by_account.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Use this macro to add additional filters
+name: kubernetes_azure_detect_RBAC_authorization_by_account