From 53bf23562239f1545d504200ca701961b051e223 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 24 Aug 2021 14:39:15 +0200 Subject: [PATCH 01/10] k8s scanner detection --- .../kubernetes_scanner_image_pulling.yml | 54 +++++++++++++++++++ macros/kube_objects_events.yml | 4 ++ .../kubernetes_scanner_image_pulling.test.yml | 12 +++++ 3 files changed, 70 insertions(+) create mode 100644 detections/cloud/kubernetes_scanner_image_pulling.yml create mode 100644 macros/kube_objects_events.yml create mode 100644 tests/cloud/kubernetes_scanner_image_pulling.test.yml diff --git a/detections/cloud/kubernetes_scanner_image_pulling.yml b/detections/cloud/kubernetes_scanner_image_pulling.yml new file mode 100644 index 0000000000..b998722475 --- /dev/null +++ b/detections/cloud/kubernetes_scanner_image_pulling.yml @@ -0,0 +1,54 @@ +name: Kubernetes Scanner Image Pulling +id: 4890cd6b-0112-4974-a272-c5c153aee551 +version: 1 +date: '2021-08-24' +author: Patrick Bareiss, Splunk +type: TTP +datamodel: [] +description: This search uses the Kubernetes logs from Splunk Connect from Kubernetes to + detect Kubernetes Security Scanner. +search: '`kube_objects_events` object.message IN ("Pulling image *kube-hunter*", "Pulling image *kube-bench*", "Pulling image *kube-recon*", "Pulling image *kube-recon*") + | rename object.* AS * + | rename involvedObject.* AS * + | rename source.host AS host + | stats min(_time) as firstTime max(_time) as lastTime count by host, cluster_name, name, namespace, kind, reason, message + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `kubernetes_scanner_image_pulling_filter`' +how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes. +known_false_positives: unknown +references: +- https://github.com/splunk/splunk-connect-for-kubernetes +tags: + analytic_story: + - Dev Sec Ops + asset_type: Kubernetes + cis20: + - CIS 13 + confidence: 70 + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: Kubernetes Scanner image pulled on host $host$ + mitre_attack_id: + - T1526 + nist: + - PR.DS + - PR.AC + - DE.CM + observable: + - name: host + type: Entity + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - object.message + - source.host + - object.involvedObject.name + - object.involvedObject.namespace + - object.involvedObject.kind + - object.message + - object.reason + risk_score: 49 + security_domain: network diff --git a/macros/kube_objects_events.yml b/macros/kube_objects_events.yml new file mode 100644 index 0000000000..be9ca1b2c7 --- /dev/null +++ b/macros/kube_objects_events.yml @@ -0,0 +1,4 @@ +definition: sourcetype="kube:objects:events" +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: kube_objects_events diff --git a/tests/cloud/kubernetes_scanner_image_pulling.test.yml b/tests/cloud/kubernetes_scanner_image_pulling.test.yml new file mode 100644 index 0000000000..a96914f719 --- /dev/null +++ b/tests/cloud/kubernetes_scanner_image_pulling.test.yml @@ -0,0 +1,12 @@ +name: Kubernetes Scanner Image Pulling Unit Test +tests: +- name: Kubernetes Scanner Image Pulling + file: cloud/kubernetes_scanner_image_pulling + pass_condition: '| stats count | where count > 0' + earliest_time: '-7d' + latest_time: 'now' + attack_data: + - file_name: kubernetes_kube_hunter.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1526/kubernetes_kube_hunter/kubernetes_kube_hunter.json + sourcetype: kube:objects:events + source: kubernetes From 080eae88ef89dd6c88a0521bcaeae121c22f307b Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 24 Aug 2021 14:48:31 +0200 Subject: [PATCH 02/10] k8s scanner detection --- tests/cloud/kubernetes_scanner_image_pulling.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/cloud/kubernetes_scanner_image_pulling.test.yml b/tests/cloud/kubernetes_scanner_image_pulling.test.yml index a96914f719..5d8b50443a 100644 --- a/tests/cloud/kubernetes_scanner_image_pulling.test.yml +++ b/tests/cloud/kubernetes_scanner_image_pulling.test.yml @@ -1,7 +1,7 @@ name: Kubernetes Scanner Image Pulling Unit Test tests: - name: Kubernetes Scanner Image Pulling - file: cloud/kubernetes_scanner_image_pulling + file: cloud/kubernetes_scanner_image_pulling.yml pass_condition: '| stats count | where count > 0' earliest_time: '-7d' latest_time: 'now' From 728f647b264fb7ca31148438e517786b4857eb7d Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 24 Aug 2021 16:34:48 +0200 Subject: [PATCH 03/10] k8s scanner --- detections/cloud/kubernetes_scanner_image_pulling.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/kubernetes_scanner_image_pulling.yml b/detections/cloud/kubernetes_scanner_image_pulling.yml index b998722475..cab480da83 100644 --- a/detections/cloud/kubernetes_scanner_image_pulling.yml +++ b/detections/cloud/kubernetes_scanner_image_pulling.yml @@ -11,7 +11,7 @@ search: '`kube_objects_events` object.message IN ("Pulling image *kube-hunter*", | rename object.* AS * | rename involvedObject.* AS * | rename source.host AS host - | stats min(_time) as firstTime max(_time) as lastTime count by host, cluster_name, name, namespace, kind, reason, message + | stats min(_time) as firstTime max(_time) as lastTime count by host, name, namespace, kind, reason, message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kubernetes_scanner_image_pulling_filter`' how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes. From 6b4f6a60cebdd28827ddf175a153910fe7e9acdb Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Wed, 25 Aug 2021 09:55:42 +0200 Subject: [PATCH 04/10] k8s scanner --- detections/cloud/kubernetes_scanner_image_pulling.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/cloud/kubernetes_scanner_image_pulling.yml b/detections/cloud/kubernetes_scanner_image_pulling.yml index cab480da83..b3229a8415 100644 --- a/detections/cloud/kubernetes_scanner_image_pulling.yml +++ b/detections/cloud/kubernetes_scanner_image_pulling.yml @@ -52,3 +52,4 @@ tags: - object.reason risk_score: 49 security_domain: network + From fed6fc95024f1aea2f5e322b695a78975b5d6727 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Wed, 25 Aug 2021 10:49:51 +0200 Subject: [PATCH 05/10] k8s scanner --- macros/kube_objects_events.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/macros/kube_objects_events.yml b/macros/kube_objects_events.yml index be9ca1b2c7..ae4dd70960 100644 --- a/macros/kube_objects_events.yml +++ b/macros/kube_objects_events.yml @@ -1,4 +1,4 @@ -definition: sourcetype="kube:objects:events" +definition: sourcetype=kube:objects:events description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. name: kube_objects_events From cfa735bde414b4c8536113faf2b8999887ebdbb3 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 25 Aug 2021 09:10:24 +0000 Subject: [PATCH 06/10] Added detection testing service results inKubernetes Scanner Image Pulling --- .../kubernetes_scanner_image_pulling.yml | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/detections/cloud/kubernetes_scanner_image_pulling.yml b/detections/cloud/kubernetes_scanner_image_pulling.yml index b3229a8415..5346d484af 100644 --- a/detections/cloud/kubernetes_scanner_image_pulling.yml +++ b/detections/cloud/kubernetes_scanner_image_pulling.yml @@ -5,14 +5,13 @@ date: '2021-08-24' author: Patrick Bareiss, Splunk type: TTP datamodel: [] -description: This search uses the Kubernetes logs from Splunk Connect from Kubernetes to - detect Kubernetes Security Scanner. -search: '`kube_objects_events` object.message IN ("Pulling image *kube-hunter*", "Pulling image *kube-bench*", "Pulling image *kube-recon*", "Pulling image *kube-recon*") - | rename object.* AS * - | rename involvedObject.* AS * - | rename source.host AS host - | stats min(_time) as firstTime max(_time) as lastTime count by host, name, namespace, kind, reason, message - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +description: This search uses the Kubernetes logs from Splunk Connect from Kubernetes + to detect Kubernetes Security Scanner. +search: '`kube_objects_events` object.message IN ("Pulling image *kube-hunter*", "Pulling + image *kube-bench*", "Pulling image *kube-recon*", "Pulling image *kube-recon*") + | rename object.* AS * | rename involvedObject.* AS * | rename source.host AS host + | stats min(_time) as firstTime max(_time) as lastTime count by host, name, namespace, + kind, reason, message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kubernetes_scanner_image_pulling_filter`' how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes. known_false_positives: unknown @@ -52,4 +51,6 @@ tags: - object.reason risk_score: 49 security_domain: network - + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1526/kubernetes_kube_hunter/kubernetes_kube_hunter.json From 38e69f6dab3c6d97fe4154cec0703f55c7c1b80e Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Wed, 25 Aug 2021 17:08:47 +0200 Subject: [PATCH 07/10] k8s scanner --- detections/cloud/kubernetes_scanner_image_pulling.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/detections/cloud/kubernetes_scanner_image_pulling.yml b/detections/cloud/kubernetes_scanner_image_pulling.yml index b3229a8415..cab480da83 100644 --- a/detections/cloud/kubernetes_scanner_image_pulling.yml +++ b/detections/cloud/kubernetes_scanner_image_pulling.yml @@ -52,4 +52,3 @@ tags: - object.reason risk_score: 49 security_domain: network - From f0eb7ecfce178561a0323802abe932834fce0220 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Fri, 27 Aug 2021 09:23:01 +0200 Subject: [PATCH 08/10] devsecops --- detections/cloud/kubernetes_scanner_image_pulling.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/detections/cloud/kubernetes_scanner_image_pulling.yml b/detections/cloud/kubernetes_scanner_image_pulling.yml index eac427de91..5346d484af 100644 --- a/detections/cloud/kubernetes_scanner_image_pulling.yml +++ b/detections/cloud/kubernetes_scanner_image_pulling.yml @@ -54,4 +54,3 @@ tags: automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1526/kubernetes_kube_hunter/kubernetes_kube_hunter.json - From 9107cd7b2a570777265164e13ae09094922248db Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Fri, 27 Aug 2021 10:14:17 +0200 Subject: [PATCH 09/10] small update --- detections/cloud/kubernetes_scanner_image_pulling.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/cloud/kubernetes_scanner_image_pulling.yml b/detections/cloud/kubernetes_scanner_image_pulling.yml index 5346d484af..eac427de91 100644 --- a/detections/cloud/kubernetes_scanner_image_pulling.yml +++ b/detections/cloud/kubernetes_scanner_image_pulling.yml @@ -54,3 +54,4 @@ tags: automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1526/kubernetes_kube_hunter/kubernetes_kube_hunter.json + From dac2b862fd6e1b98b7a900d3619f41e044493d67 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Fri, 27 Aug 2021 10:16:06 +0200 Subject: [PATCH 10/10] small update --- .../{validate-and-build.yml => build-and_validate.yml} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename .github/workflows/{validate-and-build.yml => build-and_validate.yml} (99%) diff --git a/.github/workflows/validate-and-build.yml b/.github/workflows/build-and_validate.yml similarity index 99% rename from .github/workflows/validate-and-build.yml rename to .github/workflows/build-and_validate.yml index bdaf0c1f93..8fbbf86819 100644 --- a/.github/workflows/validate-and-build.yml +++ b/.github/workflows/build-and_validate.yml @@ -12,7 +12,7 @@ -name: validate-and-build +name: build-and-validate on: [push, pull_request] jobs: validate-tag-if-present: