Samirbous
83406d8ce1
* [New/Tuning] Direct Kubelet API Access rules - tuned existing rule for D4C to bump-up severity to high (low FP and very susp behavior) + added 10255 port and wss url. - duplicated same rule logic for auditd/endpoint compatibility for both 10250 port in args and kubeletctl exec. - added a new one using network event vs process argument for more resilience. * ++ * Update discovery_potential_direct_kubelet_access_via_process_args.toml * Update and rename discovery_potential_direct_kubelet_access_via_process_args.toml to lateral_movement_direct_kubelet_access_via_process_args.toml * Update rules/linux/lateral_movement_direct_kubelet_access_via_process_args.toml Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> * Update rules/linux/discovery_potential_kubeletctl_execution.toml Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> * Update discovery_potential_kubeletctl_execution.toml * Update lateral_movement_kubelet_api_connection_attempt_internal_ip.toml * Apply suggestion from @Aegrah Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> * Apply suggestion from @Aegrah Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> --------- Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>