Anvilogic low experimental spl

Kubernetes Enumeration [splunk-unix]

This use case looks for when the Kubectl get command has been executed. -- Threat Actor Association: TeamTNT -- Atomics T1053.007 Test#1

View Source

Detection Logic

`get_endpoint_data` `get_endpoint_data_unix` TERM(kubectl) TERM(get)
| table _time, host, user process
| bin span=1s
| stats values(*) as * by _time, host

Field Validations

Loading…

Comments (0)

Loading comments...