KQL Search

Query Details

Kubernetes Security Configuration Tampering

Query

let Lookback = 1d;
let AllowedAdminUsers = dynamic([
	"system:serviceaccount:flux-system:kustomize-controller",
	"system:serviceaccount:argocd:argocd-application-controller"
]);
CloudAuditEvents
| where Timestamp > ago(Lookback)
| where DataSource =~ "Kubernetes Audit"
| extend Verb = tolower(coalesce(tostring(RawEventData.verb), OperationName))
| extend Resource = tolower(tostring(RawEventData.objectRef.resource))
| extend Namespace = tostring(RawEventData.objectRef.namespace), ObjectName = tostring(RawEventData.objectRef.name)
| extend User = tostring(RawEventData.user.username), SourceIp = tostring(RawEventData.sourceIPs[0])
| where Verb in ("delete", "update", "patch")
| where Resource in ("networkpolicies", "validatingwebhookconfigurations", "mutatingwebhookconfigurations", "pods", "deployments", "daemonsets")
| where ObjectName has_any ("defender", "azuredefender", "mdc", "security", "gatekeeper", "kyverno", "falco", "calico", "cilium", "network-policy", "admission")
	or Resource in ("networkpolicies", "validatingwebhookconfigurations", "mutatingwebhookconfigurations")
| where User !in (AllowedAdminUsers)
| project Timestamp, Detection="K8S defense evasion against security controls", User, SourceIp, Namespace, Resource, ObjectName, UserAgent, RawEventData

About this query

Kubernetes Security Configuration Tampering

Query Information

MITRE ATT&CK Technique(s)

Technique IDTitleLink
T1685Disable or Modify Toolshttps://attack.mitre.org/techniques/T1685

Description

Detects modifications to Kubernetes security-critical resources such as NetworkPolicies, Admission Controllers, and security-related pods (e.g., Gatekeeper, Falco, Calico) via the Kubernetes API. The rule monitors for delete, update, or patch verbs and triggers when non-authorized service accounts perform these actions against sensitive resources or security-related objects.

Author <Optional>

Defender XDR

Explanation

This query is designed to detect unauthorized modifications to critical security configurations in a Kubernetes environment. It specifically looks for actions like deleting, updating, or patching security-related resources such as NetworkPolicies, Admission Controllers, and certain security-focused pods (e.g., Gatekeeper, Falco, Calico) through the Kubernetes API.

Here's a simplified breakdown of the query:

  1. Lookback Period: The query examines events from the past day (1d).

  2. Allowed Users: It defines a list of service accounts that are permitted to make changes to these resources. These are considered authorized users.

  3. Data Source: The query filters events from the "Kubernetes Audit" data source.

  4. Actions Monitored: It focuses on the verbs "delete," "update," and "patch," which indicate modifications to resources.

  5. Sensitive Resources: The query targets specific resources like network policies, webhook configurations, and pods that are associated with security.

  6. Unauthorized Access: It checks if the user making the changes is not in the list of allowed users.

  7. Output: If an unauthorized user attempts to modify these critical resources, the query logs details such as the timestamp, user, source IP, namespace, resource, and object name, labeling it as a "K8S defense evasion against security controls."

In essence, this query helps identify potential security breaches where unauthorized users attempt to tamper with Kubernetes security configurations.