Elastic medium stable eql

Kubeconfig File Creation or Modification

The kubeconfig file is a critical component in Kubernetes environments, containing configuration details for accessing and managing Kubernetes clusters. Attackers may attempt to get access to, create or modify kubeconfig files to gain unauthorized initial access to Kubernetes clusters or move laterally within the cluster.

View Source

Detection Logic

file where host.os.type == "linux" and event.type != "deletion" and file.path like (
  "/root/.kube/config",
  "/home/*/.kube/config",
  "/etc/kubernetes/admin.conf",
  "/etc/kubernetes/super-admin.conf",
  "/etc/kubernetes/kubelet.conf",
  "/etc/kubernetes/controller-manager.conf",
  "/etc/kubernetes/scheduler.conf",
  "/var/lib/*/kubeconfig"
) and not (
  process.name in ("kubeadm", "kubelet", "vcluster", "minikube", "kind") or
  (process.name == "sed" and ?file.Ext.original.name like "sed*") or
  process.executable like (
    "/usr/local/bin/k3d", "/usr/local/aws-cli/*/dist/aws", "/usr/local/bin/ks", "/usr/local/bin/aws",
    "/usr/local/bin/kubectl"
  )
)

Field Validations

Loading…

Comments (0)

Loading comments...