security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] Removing host.os.type from K8s Rules (#5577)

Browse Source
This commit is contained in:
Ruben Groenewoud
2026-01-23 10:41:20 +01:00
committed by GitHub
parent 4e4559204d
commit 4408ea014b
5 changed files with 10 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/integrations/kubernetes/defense_evasion_events_deleted.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2025/06/27"
integration = ["kubernetes"]
maturity = "production"
updated_date = "2025/07/07"
updated_date = "2026/01/19"
[rule]
author = ["Elastic"]
@@ -62,7 +62,7 @@ tags = [
timestamp_override = "event.ingested"
type = "eql"
query = '''
any where host.os.type == "linux" and event.dataset == "kubernetes.audit_logs" and kubernetes.audit.verb == "delete" and
any where event.dataset == "kubernetes.audit_logs" and kubernetes.audit.verb == "delete" and
kubernetes.audit.objectRef.resource == "events" and kubernetes.audit.stage == "ResponseComplete"
'''
rules/integrations/kubernetes/execution_forbidden_creation_request.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2025/06/24"
integration = ["kubernetes"]
maturity = "production"
updated_date = "2025/07/07"
updated_date = "2026/01/19"
[rule]
author = ["Elastic"]
@@ -67,7 +67,7 @@ tags = [
timestamp_override = "event.ingested"
type = "eql"
query = '''
any where host.os.type == "linux" and event.dataset == "kubernetes.audit_logs" and kubernetes.audit.verb == "create" and
any where event.dataset == "kubernetes.audit_logs" and kubernetes.audit.verb == "create" and
kubernetes.audit.stage == "ResponseComplete" and `kubernetes.audit.annotations.authorization_k8s_io/decision` == "forbid"
'''
rules/integrations/kubernetes/execution_forbidden_request_from_unsual_user_agent.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2025/06/17"
integration = ["kubernetes"]
maturity = "production"
updated_date = "2025/07/07"
updated_date = "2026/01/19"
[rule]
author = ["Elastic"]
@@ -59,7 +59,7 @@ tags = ["Data Source: Kubernetes", "Tactic: Execution", "Resources: Investigatio
timestamp_override = "event.ingested"
type = "eql"
query = '''
any where host.os.type == "linux" and event.dataset == "kubernetes.audit_logs" and
any where event.dataset == "kubernetes.audit_logs" and
kubernetes.audit.stage == "ResponseComplete" and `kubernetes.audit.annotations.authorization_k8s_io/decision` == "forbid" and
not user_agent.original like~ (
"/", "karpenter", "csi-secrets-store/*", "elastic-agent/*", "agentbeat/*", "insights-operator*", "oc/*", "cloud-defend/*",
rules/integrations/kubernetes/execution_unusual_request_response_by_user_agent.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2025/06/18"
integration = ["kubernetes"]
maturity = "production"
updated_date = "2025/07/21"
updated_date = "2026/01/19"
[rule]
author = ["Elastic"]
@@ -67,7 +67,7 @@ tags = [
timestamp_override = "event.ingested"
type = "new_terms"
query = '''
host.os.type:"linux" and event.dataset:"kubernetes.audit_logs" and kubernetes.audit.stage:"ResponseComplete" and user_agent.original:*
event.dataset:"kubernetes.audit_logs" and kubernetes.audit.stage:"ResponseComplete" and user_agent.original:*
'''
[[rule.threat]]
rules/integrations/kubernetes/execution_user_exec_to_pod.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2022/05/17"
integration = ["kubernetes"]
maturity = "production"
updated_date = "2025/06/18"
updated_date = "2026/01/19"
[rule]
author = ["Elastic"]
@@ -75,7 +75,7 @@ tags = ["Data Source: Kubernetes", "Tactic: Execution", "Resources: Investigatio
timestamp_override = "event.ingested"
type = "eql"
query = '''
any where host.os.type == "linux" and event.dataset == "kubernetes.audit_logs" and
any where event.dataset == "kubernetes.audit_logs" and
kubernetes.audit.verb in ("get", "create") and kubernetes.audit.objectRef.subresource == "exec" and
kubernetes.audit.stage == "ResponseComplete" and `kubernetes.audit.annotations.authorization_k8s_io/decision` == "allow"
'''