Cyber Security: Kubernetes Source

Source Description

This source uses Kubernetes cluster audit logs. Its rules detect anonymous and unauthorized API access, permission enumeration, secret reads, command execution in containers, privileged pod creation, role and binding changes, and deletion of audit events.

The rules analyze the subject, action, resource, namespace, and authorization decision in cluster API requests. For modifying requests, they also analyze the request body.

Collection Requirements

• configure the kube-apiserver audit policy and audit log settings; see Configuring Infrastructure Sources
• use the Kubernetes collection configuration; see Connecting and Configuring Data Collection

MITRE ATT&CK Coverage

The source rules cover the following tactics.

• reconnaissance
• initial access
• execution
• persistence
• privilege escalation
• stealth
• credential access
• discovery

Lookups

The source rules do not use lookups. Exclude legitimate automation (CI runners and operators) in rule conditions; see Tuning for Your Infrastructure.

Documents Included with the Module

The "Cyber Security Expertise Description" document included with the module lists the source rules, their MITRE ATT&CK tactics and techniques, identifiers, and lookups.