Elastic low stable kql

Unusual Kubernetes Sensitive Workload Modification

Detects the creation or modification of several sensitive workloads, such as DaemonSets, Deployments, or CronJobs, by an unusual user agent, source IP and username, which may indicate privilege escalation or unauthorized access within the cluster.

View Source

Detection Logic

data_stream.dataset:"kubernetes.audit_logs" and user_agent.original:* and
kubernetes.audit.annotations.authorization_k8s_io/decision:"allow" and
kubernetes.audit.objectRef.resource:("daemonsets" or "deployments" or "cronjobs") and
kubernetes.audit.verb:("create" or "patch") and
not kubernetes.audit.user.groups:"system:masters"

Field Validations

Loading…

Comments (0)

Loading comments...