Elastic Defend high stable eql

Script DNS Query to Managed Kubernetes Cluster

Identifies a scripting interpreter or download utility followed within one minute by a DNS lookup of a managed Kubernetes cluster API hostname (AWS EKS, Azure AKS, Google GKE, or Vultr Kubernetes). Adversaries and post-exploitation tooling may use shells, download utilities, or language runtimes to reach cluster control planes after harvesting kubeconfig credentials or service account tokens.

View Source

Detection Logic

sequence by process.entity_id with maxspan=1m
  [process where event.type == "start" and event.action == "exec" and (
    process.name in (
      "fish", "zsh", "bash", "dash", "sh", "tcsh", "csh", "ksh", "curl", "wget", "node", "bun", "deno", "pwsh",
      "busybox", "timeout", "env", "java"
    ) or
    process.name like ("python*", "perl*", "php*", "ruby*", "lua*")
  )
  and not (process.name in ("fish", "zsh", "bash", "dash", "sh", "tcsh", "csh", "ksh") and process.args like ("*kubectl*", "*/shims/k9s"))
  ]
  [dns where dns.question.name like~ ("*eks.amazonaws.com", "*.azmk8s.io", "*.gke.goog", "*.vultr-k8s.com")]

Field Validations

Loading…

Comments (0)

Loading comments...