From 207e76e774907d7c1c9939571c579977900fb127 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Fri, 11 Nov 2022 11:51:20 -0800 Subject: [PATCH] minor fix --- .../kubernetes_aws_detect_suspicious_kubectl_calls.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/experimental/cloud/kubernetes_aws_detect_suspicious_kubectl_calls.yml b/detections/experimental/cloud/kubernetes_aws_detect_suspicious_kubectl_calls.yml index 21f6d988de..996b8ead9d 100644 --- a/detections/experimental/cloud/kubernetes_aws_detect_suspicious_kubectl_calls.yml +++ b/detections/experimental/cloud/kubernetes_aws_detect_suspicious_kubectl_calls.yml @@ -1,14 +1,14 @@ name: Kubernetes AWS detect suspicious kubectl calls id: 042a3d32-8318-4763-9679-09db2644a8f2 -version: 1 -date: '2020-06-23' +version: 2 +date: '2022-11-11' author: Rod Soto, Splunk type: Hunting datamodel: [] description: This search provides information on anonymous Kubectl calls with IP, verb namespace and object access context search: '`aws_cloudwatchlogs_eks` userAgent=kubectl* sourceIPs{}!=127.0.0.1 sourceIPs{}!=::1 - src_user=system:anonymous | table src_ip src_user verb userAgent requestURI | + src_user=system:anonymous | stats count by src_ip src_user verb userAgent requestURI |`kubernetes_aws_detect_suspicious_kubectl_calls_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with cloudwatch logs.