mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
P4T12ICK
43 lines
1.4 KiB
YAML
43 lines
1.4 KiB
YAML
name: AWS EKS Kubernetes cluster sensitive object access
|
|
id: 7f227943-2196-4d4d-8d6a-ac8cb308e61c
|
|
version: 1
|
|
date: '2020-06-23'
|
|
author: Rod Soto, Splunk
|
|
type: Hunting
|
|
datamodel: []
|
|
description: This search provides information on Kubernetes accounts accessing sensitve
|
|
objects such as configmaps or secrets
|
|
search: '`aws_cloudwatchlogs_eks` objectRef.resource=secrets OR configmaps sourceIPs{}!=::1
|
|
sourceIPs{}!=127.0.0.1 |table sourceIPs{} user.username user.groups{} objectRef.resource
|
|
objectRef.namespace objectRef.name annotations.authorization.k8s.io/reason |dedup
|
|
user.username user.groups{} |`aws_eks_kubernetes_cluster_sensitive_object_access_filter`'
|
|
how_to_implement: You must install Splunk Add-on for Amazon Web Services and Splunk
|
|
App for AWS. This search works with cloudwatch logs.
|
|
known_false_positives: Sensitive object access is not necessarily malicious but user
|
|
and object context can provide guidance for detection.
|
|
references: []
|
|
tags:
|
|
analytic_story:
|
|
- Kubernetes Sensitive Object Access Activity
|
|
asset_type: AWS EKS Kubernetes cluster
|
|
kill_chain_phases:
|
|
- Exploitation
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
security_domain: threat
|
|
confidence: 50
|
|
impact: 50
|
|
risk_score: 25
|
|
context:
|
|
- Unknown
|
|
message: tbd
|
|
observable:
|
|
- name: field
|
|
type: Unknown
|
|
role:
|
|
- Unknown
|