mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Bhavin Patel
62 lines
2.3 KiB
YAML
62 lines
2.3 KiB
YAML
name: Kubernetes Scanner Image Pulling
|
|
id: 4890cd6b-0112-4974-a272-c5c153aee551
|
|
version: 2
|
|
date: '2024-05-20'
|
|
author: Patrick Bareiss, Splunk
|
|
status: production
|
|
type: TTP
|
|
description: The following analytic detects the pulling of known Kubernetes security
|
|
scanner images such as kube-hunter, kube-bench, and kube-recon. It leverages Kubernetes
|
|
logs ingested through Splunk Connect for Kubernetes, specifically monitoring for
|
|
messages indicating the pulling of these images. This activity is significant because
|
|
the use of security scanners can indicate an attempt to identify vulnerabilities
|
|
within the Kubernetes environment. If confirmed malicious, this could lead to the
|
|
discovery and exploitation of security weaknesses, potentially compromising the
|
|
entire Kubernetes cluster.
|
|
data_source: []
|
|
search: '`kube_objects_events` object.message IN ("Pulling image *kube-hunter*", "Pulling
|
|
image *kube-bench*", "Pulling image *kube-recon*", "Pulling image *kube-recon*")
|
|
| rename object.* AS * | rename involvedObject.* AS * | rename source.host AS host
|
|
| eval phase="operate" | eval severity="high" | stats min(_time) as firstTime max(_time)
|
|
as lastTime count by host, name, namespace, kind, reason, message, phase, severity
|
|
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kubernetes_scanner_image_pulling_filter`'
|
|
how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
|
|
known_false_positives: unknown
|
|
references:
|
|
- https://github.com/splunk/splunk-connect-for-kubernetes
|
|
tags:
|
|
analytic_story:
|
|
- Dev Sec Ops
|
|
asset_type: Kubernetes
|
|
confidence: 90
|
|
impact: 90
|
|
message: Kubernetes Scanner image pulled on host $host$
|
|
mitre_attack_id:
|
|
- T1526
|
|
observable:
|
|
- name: host
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- object.message
|
|
- source.host
|
|
- object.involvedObject.name
|
|
- object.involvedObject.namespace
|
|
- object.involvedObject.kind
|
|
- object.message
|
|
- object.reason
|
|
risk_score: 81
|
|
security_domain: network
|
|
tests:
|
|
- name: True Positive Test
|
|
attack_data:
|
|
- data:
|
|
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1526/kubernetes_kube_hunter/kubernetes_kube_hunter.json
|
|
sourcetype: kube:objects:events
|
|
source: kubernetes
|