admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
srv-rr-gh-researchbt
2022-11-11 12:01:13 -08:00
committed by GitHub
parent b603ede096 0a0ea1435f
commit e9a7b39ba6
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/experimental/cloud/kubernetes_aws_detect_suspicious_kubectl_calls.yml
+3 -3
View File
@@ -1,14 +1,14 @@
name: Kubernetes AWS detect suspicious kubectl calls
id: 042a3d32-8318-4763-9679-09db2644a8f2
version: 1
date: '2020-06-23'
version: 2
date: '2022-11-11'
author: Rod Soto, Splunk
type: Hunting
datamodel: []
description: This search provides information on anonymous Kubectl calls with IP,
verb namespace and object access context
search: '`aws_cloudwatchlogs_eks` userAgent=kubectl* sourceIPs{}!=127.0.0.1 sourceIPs{}!=::1
src_user=system:anonymous | table src_ip src_user verb userAgent requestURI |
src_user=system:anonymous |
stats count by src_ip src_user verb userAgent requestURI |`kubernetes_aws_detect_suspicious_kubectl_calls_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with cloudwatch logs.