gcpRBACdetection

detections/kubernetes_gcp_detect_RBAC_authorizations_by_account.yml

@@ -0,0 +1,18 @@
+author: "Rod Soto, Splunk"
+date: "2020-07-11"
+description: "This search provides information on Kubernetes RBAC authorizations by accounts, this search can be modified by adding top to see both extremes of RBAC by accounts occurrences"
+how_to_implement: "You must install splunk AWS add on for GCP. This search works with pubsub messaging service logs"
+id: 99487de3-7192-4b41-939d-fbe9acfb1340
+known_false_positives: "Not all RBAC Authorications are malicious. RBAC authorizations can uncover malicious activity specially if sensitive Roles have been granted."
+name: "GCP GKE Kubernetes RBAC authorizations by account"
+references: []
+search: sourcetype=google:gcp:pubsub:message data.labels.authorization.k8s.io/reason=ClusterRoleBinding OR Clusterrole  | table src_ip src_user data.labels.authorization.k8s.io/decision data.labels.authorization.k8s.io/reason | rare src_user data.labels.authorization.k8s.io/reason |`kubernetes_gcp_detect_RBAC_authorization_by_account`
+tags:
+  analytics_story:
+    - "Kubernetes Sensitive Role Activity"
+  asset_type: "GCP GKE Kubernetes cluster"
+  kill_chain_phases:
+    - Lateral Movement
+  security_domain: threat
+type: ESCU
+version: 1

macros/kubernetes_gcp_detect_RBAC_authorization_by_account.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Use this macro to add additional filters
+name: kubernetes_gcp_detect_RBAC_authorization_by_account