name: Kubernetes Scanner Image Pulling
id: 4890cd6b-0112-4974-a272-c5c153aee551
version: 1
date: '2021-08-24'
author: Patrick Bareiss, Splunk
type: TTP
datamodel: []
description: This search uses the Kubernetes logs from Splunk Connect from Kubernetes
  to detect Kubernetes Security Scanner.
search: '`kube_objects_events` object.message IN ("Pulling image *kube-hunter*", "Pulling
  image *kube-bench*", "Pulling image *kube-recon*", "Pulling image *kube-recon*")
  | rename object.* AS * | rename involvedObject.* AS * | rename source.host AS host
  | eval phase="operate" | eval severity="high" | stats min(_time) as firstTime max(_time)
  as lastTime count by host, name, namespace, kind, reason, message, phase, severity
  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kubernetes_scanner_image_pulling_filter`'
how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
known_false_positives: unknown
references:
- https://github.com/splunk/splunk-connect-for-kubernetes
tags:
  analytic_story:
  - Dev Sec Ops
  asset_type: Kubernetes
  cis20:
  - CIS 13
  confidence: 90
  context:
  - Unknown
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1526/kubernetes_kube_hunter/kubernetes_kube_hunter.json
  deployments:
  - Slack Alert
  impact: 90
  kill_chain_phases:
  - Actions on Objectives
  message: Kubernetes Scanner image pulled on host $host$
  mitre_attack_id:
  - T1526
  nist:
  - PR.DS
  - PR.AC
  - DE.CM
  observable:
  - name: host
    type: Hostname
    role:
    - Attacker
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - object.message
  - source.host
  - object.involvedObject.name
  - object.involvedObject.namespace
  - object.involvedObject.kind
  - object.message
  - object.reason
  risk_score: 81
  security_domain: network