Elastic low stable eql

Kubeconfig File Discovery

The kubeconfig file is a critical component in Kubernetes environments, containing configuration details for accessing and managing Kubernetes clusters. Attackers may attempt to get access to, create, or modify kubeconfig files to gain unauthorized initial access to Kubernetes clusters or move laterally within the cluster. This rule detects process discovery executions that involve kubeconfig files, particularly those executed from common shell environments or world-writeable directories.

View Source

Detection Logic

process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and (
  process.parent.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") or
  (
    process.parent.executable like ("/tmp/*", "/var/tmp/*", "/dev/shm/*", "/root/*", "/home/*") or
    process.parent.name like (".*", "*.sh")
  )
) and
(
  (
    process.working_directory like ("/etc/kubernetes", "/root/.kube", "/home/*/.kube") and
    process.args in ("kubeconfig", "admin.conf", "super-admin.conf", "kubelet.conf", "controller-manager.conf", "scheduler.conf")
  ) or
  process.args like (
    "/etc/kubernetes/admin.conf",
    "/etc/kubernetes/super-admin.conf",
    "/etc/kubernetes/kubelet.conf",
    "/etc/kubernetes/controller-manager.conf",
    "/etc/kubernetes/scheduler.conf",
    "/home/*/.kube/config",
    "/root/.kube/config",
    "/var/lib/*/kubeconfig"
  )
) and not (
  process.name in ("stat", "md5sum", "dirname") or
  (process.name like "python*" and process.args == "/usr/bin/yq" and process.parent.name == "fish") or
  process.executable in (
    "/usr/bin/file", "/usr/bin/readlink", "/bin/readlink", "/bin/file", "/tmp/newroot/bin/readlink",
    "/tmp/newroot/bin/file", "/usr/local/bin/helm"
  )
)

Field Validations

Loading…

Comments (0)

Loading comments...