mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
P4T12ICK
59 lines
1.9 KiB
YAML
59 lines
1.9 KiB
YAML
name: Kubernetes Scanner Image Pulling
|
|
id: 4890cd6b-0112-4974-a272-c5c153aee551
|
|
version: 1
|
|
date: '2021-08-24'
|
|
author: Patrick Bareiss, Splunk
|
|
type: TTP
|
|
datamodel: []
|
|
description: This search uses the Kubernetes logs from Splunk Connect from Kubernetes
|
|
to detect Kubernetes Security Scanner.
|
|
search: '`kube_objects_events` object.message IN ("Pulling image *kube-hunter*", "Pulling
|
|
image *kube-bench*", "Pulling image *kube-recon*", "Pulling image *kube-recon*")
|
|
| rename object.* AS * | rename involvedObject.* AS * | rename source.host AS host
|
|
| eval phase="operate" | eval severity="high"
|
|
| stats min(_time) as firstTime max(_time) as lastTime count by host, name, namespace,
|
|
kind, reason, message, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
|
|
| `kubernetes_scanner_image_pulling_filter`'
|
|
how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
|
|
known_false_positives: unknown
|
|
references:
|
|
- https://github.com/splunk/splunk-connect-for-kubernetes
|
|
tags:
|
|
analytic_story:
|
|
- Dev Sec Ops
|
|
asset_type: Kubernetes
|
|
automated_detection_testing: passed
|
|
cis20:
|
|
- CIS 13
|
|
confidence: 90
|
|
dataset:
|
|
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1526/kubernetes_kube_hunter/kubernetes_kube_hunter.json
|
|
impact: 90
|
|
kill_chain_phases:
|
|
- Actions on Objectives
|
|
message: Kubernetes Scanner image pulled on host $host$
|
|
mitre_attack_id:
|
|
- T1526
|
|
nist:
|
|
- PR.DS
|
|
- PR.AC
|
|
- DE.CM
|
|
observable:
|
|
- name: host
|
|
type: Entity
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
- Dev Sec Ops Analytics
|
|
required_fields:
|
|
- object.message
|
|
- source.host
|
|
- object.involvedObject.name
|
|
- object.involvedObject.namespace
|
|
- object.involvedObject.kind
|
|
- object.message
|
|
- object.reason
|
|
risk_score: 81
|
|
security_domain: network
|