Elastic medium stable eql

Kubernetes Direct API Request via Curl or Wget

This rule monitors for the execution of curl or wget commands that directly access Kubernetes API endpoints, which may indicate an attempt to interact with Kubernetes resources in a potentially unauthorized manner. This technique is often used by adversaries to gather information about the Kubernetes environment, such as secrets, config maps, and other sensitive data, without using the official Kubernetes client tools such as "kubectl".

View Source

Detection Logic

process where event.type == "start" and
event.action in ("exec", "exec_event", "start", "executed", "process_started", "ProcessRollup2") and
process.name : ("curl", "wget", "curl.exe", "wget.exe") and process.command_line like~ (
  "*http*//*/apis/authorization.k8s.io/*",
  "*http*//*/apis/rbac.authorization.k8s.io/*",
  "*http*//*/api/v1/secrets*",
  "*http*//*/api/v1/namespaces/*/secrets*",
  "*http*//*/api/v1/configmaps*",
  "*http*//*/api/v1/pods*",
  "*http*//*/apis/apps/v1/deployments*"
)

Field Validations

Loading…

Comments (0)

Loading comments...