From ef98461e89c17a56f23450f10ce9680b5e184d04 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Fri, 17 Jul 2020 22:11:19 -0400 Subject: [PATCH 1/2] newgcpk8podsearch --- ..._kubernetes_cluster_pod_scan_detection.yml | 24 +++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 detections/gcp_kubernetes_cluster_pod_scan_detection.yml diff --git a/detections/gcp_kubernetes_cluster_pod_scan_detection.yml b/detections/gcp_kubernetes_cluster_pod_scan_detection.yml new file mode 100644 index 0000000000..fcc4903f5c --- /dev/null +++ b/detections/gcp_kubernetes_cluster_pod_scan_detection.yml @@ -0,0 +1,24 @@ +name: GCP Kubernetes cluster pod scan detection +id: 19b53215-4a16-405b-8087-9e6acf619842 +version: 1 +date: '2020-07-17' +description: This search provides information of unauthenticated requests via user + agent, and authentication data against Kubernetes cluster's pods +how_to_implement: You must install the GCP App for Splunk (version 2.0.0 or later), + then configure stackdriver and set a Pub/Sub subscription to be imported to Splunk. + You must also install Cloud Infrastructure data model.Customize the macro kubernetes_gcp_pod_scan_fingerprint_attack_detection + to filter out FPs. +type: ESCU +references: [] +author: Rod Soto, Splunk +search: '`google_gcp_pubsub_message` category=kube-audit |spath input=properties.log |search responseStatus.code=401 |table sourceIPs{} userAgent verb requestURI responseStatus.reason properties.pod | `gcp_kubernetes_cluster_pod_scan_detection_filter`' +known_false_positives: Not all unauthenticated requests are malicious, but frequency, User Agent, source IPs and pods will provide context. +tags: + analytics_story: + - Kubernetes Scanning Activity + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1526 + security_domain: threat + asset_type: GCP Kubernetes cluster From bb906c721a4597dea4471af0d1872528d7a6b12a Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 20 Jul 2020 10:47:18 -0700 Subject: [PATCH 2/2] Update gcp_kubernetes_cluster_pod_scan_detection.yml corrected how to implement --- detections/gcp_kubernetes_cluster_pod_scan_detection.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/detections/gcp_kubernetes_cluster_pod_scan_detection.yml b/detections/gcp_kubernetes_cluster_pod_scan_detection.yml index fcc4903f5c..502146513c 100644 --- a/detections/gcp_kubernetes_cluster_pod_scan_detection.yml +++ b/detections/gcp_kubernetes_cluster_pod_scan_detection.yml @@ -6,8 +6,6 @@ description: This search provides information of unauthenticated requests via us agent, and authentication data against Kubernetes cluster's pods how_to_implement: You must install the GCP App for Splunk (version 2.0.0 or later), then configure stackdriver and set a Pub/Sub subscription to be imported to Splunk. - You must also install Cloud Infrastructure data model.Customize the macro kubernetes_gcp_pod_scan_fingerprint_attack_detection - to filter out FPs. type: ESCU references: [] author: Rod Soto, Splunk