KQL Search

Query Details

Kubernetes Workload Creation From Unapproved Registry

Query

let Lookback = 1d;
let AllowedAdminUsers = dynamic([
	"system:serviceaccount:flux-system:kustomize-controller",
	"system:serviceaccount:argocd:argocd-application-controller"
]);
let AllowedRegistries = dynamic([
	"mcr.microsoft.com/",
	"ghcr.io/your-org/"
]);
CloudAuditEvents
| where Timestamp > ago(Lookback)
| where DataSource =~ "Kubernetes Audit"
| extend Verb = tolower(coalesce(tostring(RawEventData.verb), OperationName))
| extend Resource = tolower(tostring(RawEventData.objectRef.resource))
| where Verb in ("create", "update", "patch")
| where Resource in ("pods", "deployments", "daemonsets", "statefulsets", "jobs", "cronjobs")
| extend Namespace = tostring(RawEventData.objectRef.namespace), Workload = tostring(RawEventData.objectRef.name)
| extend User = tostring(RawEventData.user.username), SourceIp = tostring(RawEventData.sourceIPs[0])
| extend RequestObject = tostring(RawEventData.requestObject)
| extend Images = extract_all(@'"image"\s*:\s*"([^"]+)"', RequestObject)
| mv-expand Image = Images to typeof(string)
| extend ImageLower = tolower(Image)
| where not(ImageLower startswith tostring(AllowedRegistries[0]) or ImageLower startswith tostring(AllowedRegistries[1]) or ImageLower startswith tostring(AllowedRegistries[2]))
| where ImageLower has_any (":latest", "docker.io/", "public.ecr.aws/", "quay.io/") or User !in (AllowedAdminUsers)
| project Timestamp, Detection="K8S workload from unapproved registry", User, SourceIp, Namespace, Resource, Workload, Image, UserAgent, RawEventData

About this query

Kubernetes Workload Creation from Unapproved Registry

Query Information

MITRE ATT&CK Technique(s)

Technique IDTitleLink
T1610Deploy Containerhttps://attack.mitre.org/techniques/T1610
T1204.003Malicious Imagehttps://attack.mitre.org/techniques/T1204/003

Description

This rule monitors Kubernetes audit logs for the creation, update, or patching of core workload resources (pods, deployments, etc.) that utilize container images from unapproved registries. It enforces image registry allowlisting and ensures that workload modifications are performed by authorized service accounts.

Author <Optional>

Defender XDR

Explanation

This query is designed to monitor Kubernetes audit logs for any creation, update, or modification of core workload resources (such as pods, deployments, etc.) that use container images from registries that are not approved. Here's a simplified breakdown of what the query does:

  1. Time Frame: It looks at events from the past day (Lookback = 1d).

  2. Allowed Users and Registries:

    • It defines a list of allowed service accounts (AllowedAdminUsers) that are permitted to make changes.
    • It also specifies a list of approved container image registries (AllowedRegistries) from which images can be used.

  3. Filter Events:

    • It filters the audit logs to only include events related to Kubernetes (DataSource = "Kubernetes Audit").
    • It further narrows down the events to those where a resource is created, updated, or patched (Verb in ("create", "update", "patch")).
    • It focuses on specific resources like pods, deployments, daemonsets, statefulsets, jobs, and cronjobs.

  4. Extract and Check Images:

    • It extracts the container images used in these operations.
    • It checks if these images come from unapproved registries by comparing them against the allowed list.
    • It also flags images tagged with ":latest" or from common public registries like "docker.io/", "public.ecr.aws/", or "quay.io/" if the user is not in the allowed list.

  5. Output:

    • If a workload uses an unapproved image or is modified by an unauthorized user, it logs details such as the timestamp, user, source IP, namespace, resource type, workload name, and image used.

In essence, this query helps ensure that only authorized users can deploy or modify workloads using images from trusted registries, enhancing security by preventing the use of potentially malicious or unverified container images.