Elastic medium stable kql

Kubernetes Forbidden Request from Unusual User Agent

This rule detects when a forbidden request is made from an unusual user agent in a Kubernetes environment. Adversary tooling may use non-standard or unexpected user agents to interact with the Kubernetes API, which can indicate an attempt to evade detection or blend in with legitimate traffic. In combination with a forbidden request, this behavior can suggest an adversary is attempting to exploit vulnerabilities or misconfigurations in the Kubernetes cluster.

View Source

Detection Logic

data_stream.dataset:"kubernetes.audit_logs" and
kubernetes.audit.stage:"ResponseComplete" and
kubernetes.audit.annotations.authorization_k8s_io/decision:"forbid" and
user_agent.original:(* and not (*kubernetes/$Format))

Field Validations

Loading…

Comments (0)

Loading comments...