awssentobj

detections/kubernetes_aws_detect_sensitive_object_access.yml

@@ -0,0 +1,18 @@
+author: "Rod Soto, Splunk"
+date: "2020-06-23"
+description: "This search provides information on Kubernetes accounts accessing sensitve objects such as configmaps or secrets"
+how_to_implement: "You must install splunk AWS add on and Splunk App for AWS. This search works with cloudwatch logs."
+id: 7f227943-2196-4d4d-8d6a-ac8cb308e61c
+known_false_positives: "Sensitive object access is not necessarily malicious but user and object context can provide guidance for detection."
+name: "AWS EKS Kubernetes cluster sensitive object access detection"
+references: []
+search: sourcetype="aws:cloudwatchlogs:eks" objectRef.resource=secrets OR configmaps sourceIPs{}!=::1 sourceIPs{}!=127.0.0.1  |table sourceIPs{} user.username user.groups{} objectRef.resource objectRef.namespace objectRef.name annotations.authorization.k8s.io/reason |dedup user.username user.groups{} |`kubernetes_aws_detect_sensitive_object_access`"
+tags:
+  analytics_story:
+    - "Kubernetes Sensitive Object Access Activity"
+  asset_type: "AWS EKS Kubernetes cluster"
+  kill_chain_phases:
+    - Lateral Movement
+  security_domain: threat
+type: ESCU
+version: 1

macros/kubernetes_aws_detect_sensitive_object_access.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Use this macro to add additional filters
+name: kubernetes_aws_detect_sensitive_object_access