Interactive Access To Kubernetes Pods By Unusual User
Query
let Lookback = 1d;
let AllowedAdminUsers = dynamic([
"system:serviceaccount:flux-system:kustomize-controller",
"system:serviceaccount:argocd:argocd-application-controller"
]);
CloudAuditEvents
| where Timestamp > ago(Lookback)
| where DataSource =~ "Kubernetes Audit"
| extend Verb = tolower(coalesce(tostring(RawEventData.verb), OperationName))
| extend Resource = tolower(tostring(RawEventData.objectRef.resource)), SubResource = tolower(tostring(RawEventData.objectRef.subresource))
| where Resource == "pods" and SubResource in ("exec", "attach", "portforward")
| extend Namespace = tostring(RawEventData.objectRef.namespace), PodName = tostring(RawEventData.objectRef.name)
| extend User = tostring(RawEventData.user.username), SourceIp = tostring(RawEventData.sourceIPs[0])
| where User !in (AllowedAdminUsers)
| project Timestamp, Detection="K8S interactive pod access", User, SourceIp, Namespace, PodName, SubResource, UserAgent, RawEventDataAbout this query
Interactive Access to Kubernetes Pods by Unusual User
Query Information
MITRE ATT&CK Technique(s)
| Technique ID | Title | Link |
|---|---|---|
| T1609 | Container Administration Command | https://attack.mitre.org/techniques/T1609 |
Description
This rule monitors Kubernetes audit logs for interactive access events such as exec, attach, or port-forwarding against pods. It alerts on these activities when performed by entities other than known, legitimate service accounts like the Kustomize or ArgoCD controllers, which may indicate unauthorized administrative access or lateral movement within a cluster.
Author <Optional>
- Name: Benjamin Zulliger
- Github: https://github.com/benscha/KQLAdvancedHunting
- LinkedIn: https://www.linkedin.com/in/benjamin-zulliger/
Defender XDR
Explanation
This query is designed to monitor Kubernetes audit logs for any unusual interactive access to pods, such as executing commands, attaching, or port-forwarding. It specifically looks for these activities when they are performed by users who are not part of a predefined list of legitimate service accounts, like those used by Kustomize or ArgoCD controllers. The goal is to detect potential unauthorized access or suspicious lateral movement within the Kubernetes cluster.
Here's a simplified breakdown of the query:
- Time Frame: It examines logs from the past day (
1d). - Allowed Users: It defines a list of service accounts that are allowed to perform these actions without raising an alert.
- Data Source: It filters logs to only include those from Kubernetes audit events.
- Action Types: It focuses on actions related to pods, specifically "exec", "attach", or "portforward".
- User Check: It checks if the user performing the action is not in the list of allowed service accounts.
- Output: If an unauthorized user is detected, it logs details such as the timestamp, user, source IP, namespace, pod name, and the type of access attempted.
This helps in identifying and alerting on potentially unauthorized administrative access to Kubernetes pods.