Elastic medium stable kql

Azure AKS CoreDNS or Kube-DNS Configuration Modified

Detects an identity creating or modifying the CoreDNS or kube-dns ConfigMap in the kube-system namespace on AKS (Azure Kubernetes Service), excluding known AKS control-plane and platform identities. Rewriting cluster DNS (by editing coredns/kube-dns or creating and editing coredns-custom) enables cluster-wide adversary-in-the-middle by redirecting internal service resolution to attacker-controlled IPs, allowing credential capture and traffic interception. Coverage includes workload service accounts (system:serviceaccount:*), so a compromised in-cluster token is not excluded.

View Source

Detection Logic

data_stream.dataset:azure.platformlogs and
  event.action:"Microsoft.ContainerService/managedClusters/diagnosticLogs/Read" and
  azure.platformlogs.category:("kube-audit" or "kube-audit-admin") and
  azure.platformlogs.properties.log.stage:"ResponseComplete" and
  azure.platformlogs.properties.log.objectRef.resource:"configmaps" and
  azure.platformlogs.properties.log.objectRef.namespace:"kube-system" and
  azure.platformlogs.properties.log.objectRef.name:("coredns" or "kube-dns" or "coredns-custom") and
  azure.platformlogs.properties.log.verb:("create" or "update" or "patch" or "delete") and
  not azure.platformlogs.properties.log.user.username:(
    system\:node\:* or "aksService" or "hcpService" or "readinessChecker" or
    system\:serviceaccount\:kube-system\:*
  )

False Positives

⚠ Approved automation, platform controllers, or GitOps may update the CoreDNS ConfigMap (for example custom forward rules). Validate the identity and change window, and add exclusions for verified service accounts.

Field Validations

Loading…

Comments (0)

Loading comments...