Merge branch 'dev_sec2' of https://github.com/splunk/security_content into dev_sec2

.github/workflows/build-and_validate.yml

@@ -12,7 +12,7 @@
 
 
 
-name: validate-and-build
+name: build-and-validate
 on: [push, pull_request]
 jobs:
   validate-tag-if-present:

detections/cloud/kubernetes_scanner_image_pulling.yml

@@ -0,0 +1,57 @@
+name: Kubernetes Scanner Image Pulling
+id: 4890cd6b-0112-4974-a272-c5c153aee551
+version: 1
+date: '2021-08-24'
+author: Patrick Bareiss, Splunk
+type: TTP
+datamodel: []
+description: This search uses the Kubernetes logs from Splunk Connect from Kubernetes
+  to detect Kubernetes Security Scanner.
+search: '`kube_objects_events` object.message IN ("Pulling image *kube-hunter*", "Pulling
+  image *kube-bench*", "Pulling image *kube-recon*", "Pulling image *kube-recon*")
+  | rename object.* AS * | rename involvedObject.* AS * | rename source.host AS host
+  | stats min(_time) as firstTime max(_time) as lastTime count by host, name, namespace,
+  kind, reason, message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `kubernetes_scanner_image_pulling_filter`'
+how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
+known_false_positives: unknown
+references:
+- https://github.com/splunk/splunk-connect-for-kubernetes
+tags:
+  analytic_story:
+  - Dev Sec Ops
+  asset_type: Kubernetes
+  cis20:
+  - CIS 13
+  confidence: 70
+  impact: 70
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Kubernetes Scanner image pulled on host $host$
+  mitre_attack_id:
+  - T1526
+  nist:
+  - PR.DS
+  - PR.AC
+  - DE.CM
+  observable:
+  - name: host
+    type: Entity
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - object.message
+  - source.host
+  - object.involvedObject.name
+  - object.involvedObject.namespace
+  - object.involvedObject.kind
+  - object.message
+  - object.reason
+  risk_score: 49
+  security_domain: network
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1526/kubernetes_kube_hunter/kubernetes_kube_hunter.json
+

macros/kube_objects_events.yml

@@ -0,0 +1,4 @@
+definition: sourcetype=kube:objects:events
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: kube_objects_events

tests/cloud/kubernetes_scanner_image_pulling.test.yml

@@ -0,0 +1,12 @@
+name: Kubernetes Scanner Image Pulling Unit Test
+tests:
+- name: Kubernetes Scanner Image Pulling
+  file: cloud/kubernetes_scanner_image_pulling.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-7d'
+  latest_time: 'now'
+  attack_data:
+  - file_name: kubernetes_kube_hunter.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1526/kubernetes_kube_hunter/kubernetes_kube_hunter.json
+    sourcetype: kube:objects:events
+    source: kubernetes