KQL Search

Query Details

Kubernetes API Discovery From Workload

Query

let Lookback = 1d;
let AllowedNamespaces = dynamic([
	"kube-system",
	"gatekeeper-system",
	"azure-arc",
	"calico-system",
	"cilium"
]);
CloudProcessEvents
| where Timestamp > ago(Lookback)
| where isnotempty(KubernetesPodName)
| extend Command = tolower(ProcessCommandLine)
| where Command has_any ("kubernetes.default.svc", "kubectl get", "kubectl auth", "kubectl describe", "kubectl api-resources", "curl -k https://kubernetes", "https://10.")
| where KubernetesNamespace !in (AllowedNamespaces)
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Commands=make_set(ProcessCommandLine, 10), ProcessNames=make_set(ProcessName, 10) by AzureResourceId, KubernetesNamespace, KubernetesPodName, ContainerName, ContainerImageName, AccountName, HostName
| project FirstSeen, LastSeen, Detection="K8S API discovery from workload", AzureResourceId, KubernetesNamespace, KubernetesPodName, ContainerName, ContainerImageName, AccountName, HostName, ProcessNames, Commands

About this query

Kubernetes API Discovery from Workload

Query Information

MITRE ATT&CK Technique(s)

Technique IDTitleLink
T1613Container and Resource Discoveryhttps://attack.mitre.org/techniques/T1613
T1059.013Container CLI/APIhttps://attack.mitre.org/techniques/T1059/023

Description

Detects anomalous attempts by a containerized workload to perform Kubernetes API discovery or interact with the cluster control plane via common CLI tools (kubectl) or API endpoints (curl, internal SVC discovery). This behavior may indicate an attacker attempting to map the cluster infrastructure for further exploitation or lateral movement.

Author <Optional>

Defender XDR

Explanation

This query is designed to detect suspicious activities within a Kubernetes environment that might indicate an attacker is trying to explore or interact with the Kubernetes API. Here's a simplified breakdown of what the query does:

  1. Time Frame: It looks at events from the past day (Lookback = 1d).

  2. Allowed Namespaces: It defines a list of namespaces that are considered normal or allowed (AllowedNamespaces). These include system-related namespaces like "kube-system" and "calico-system".

  3. Event Filtering: The query examines cloud process events to find those that:

    • Have a non-empty Kubernetes pod name.
    • Involve commands that suggest interaction with the Kubernetes API or control plane, such as using kubectl commands or accessing Kubernetes service endpoints with curl.

  4. Exclusion of Allowed Namespaces: It excludes events occurring in the allowed namespaces to focus on potentially unauthorized activities.

  5. Data Aggregation: For each suspicious event, it collects information such as:

    • The first and last time the activity was seen.
    • The set of commands and process names involved.
    • Details about the resource, namespace, pod, container, and account associated with the event.

  6. Output: The query outputs a summary of these events, labeling them as "K8S API discovery from workload", which helps in identifying potential reconnaissance activities by attackers within the Kubernetes environment.

In essence, this query helps security teams identify and investigate unusual attempts to discover or interact with Kubernetes APIs from within containerized workloads, which could be a precursor to more malicious actions.