Isai
78d6093176
* [New Rule] Kubernetes Container Created with Excessive Linux Capabilites This rule detects a container deployed with one or more dangerously permissive Linux capabilities. Using the Linux capabilities feature you can grant certain privileges to a process without granting all the privileges of the root user. Added capabilities entitle containers in a pod with additional privileges that can be used to change core processes and networking settings of a cluster. An attacker with the ability to deploy a container with added capabilities could use this for further execution, lateral movement, or privilege escalation within a cluster or the host machine. This rule detects the following capabilities and leaves space for the exception of trusted permissive containers specific to your environment: BPF - Allow creating BPF maps, loading BPF Type Format (BTF) data, retrieve JITed code of BPF programs, and more. DAC_READ_SEARCH - Bypass file read permission checks and directory read and execute permission checks. NET_ADMIN - Perform various network-related operations. SYS_ADMIN - Perform a range of system administration operations. SYS_BOOT - Use reboot(2) and kexec_load(2), reboot and load a new kernel for later execution. SYS_MODULE - Load and unload kernel modules. SYS_PTRACE - Trace arbitrary processes using ptrace(2). SYS_RAWIO - Perform I/O port operations (iopl(2) and ioperm(2)). SYSLOG - Perform privileged syslog(2) operations. * Update privilege_escalation_container_created_with_excessive_linux_capabilities.toml Edited description, false positives, and elaborated with a partial investigation guide. * Update privilege_escalation_container_created_with_excessive_linux_capabilities.toml added exception to rule query * Update privilege_escalation_container_created_with_excessive_linux_capabilities.toml add Execution.Deploy Container Tactic.Technique
96 lines
3.6 KiB
JSON
96 lines
3.6 KiB
JSON
{
|
|
"endgame-*": {
|
|
"endgame": {
|
|
"metadata": {
|
|
"type": "keyword"
|
|
},
|
|
"event_subtype_full": "keyword"
|
|
}
|
|
},
|
|
"winlogbeat-*": {
|
|
"winlog": {
|
|
"event_data": {
|
|
"AccessList": "keyword",
|
|
"AccessMask": "keyword",
|
|
"AccessMaskDescription": "keyword",
|
|
"AllowedToDelegateTo": "keyword",
|
|
"AttributeLDAPDisplayName": "keyword",
|
|
"AttributeValue": "keyword",
|
|
"CallerProcessName": "keyword",
|
|
"CallTrace": "keyword",
|
|
"ClientProcessId": "keyword",
|
|
"GrantedAccess": "keyword",
|
|
"NewTargetUserName": "keyword",
|
|
"ObjectClass": "keyword",
|
|
"ObjectDN": "keyword",
|
|
"ObjectName": "keyword",
|
|
"OldTargetUserName": "keyword",
|
|
"OriginalFileName": "keyword",
|
|
"ParentProcessId": "keyword",
|
|
"ProcessName": "keyword",
|
|
"Properties": "keyword",
|
|
"RelativeTargetName": "keyword",
|
|
"ShareName": "keyword",
|
|
"SubjectLogonId": "keyword",
|
|
"SubjectUserName": "keyword",
|
|
"TargetUserName": "keyword",
|
|
"TargetImage": "keyword",
|
|
"TargetLogonId": "keyword",
|
|
"TargetProcessGUID": "keyword",
|
|
"TargetSid": "keyword",
|
|
"SchemaFriendlyName": "keyword",
|
|
"Resource": "keyword",
|
|
"PrivilegeList": "keyword",
|
|
"AuthenticationPackageName" : "keyword",
|
|
"TargetUserSid" : "keyword",
|
|
"LogonProcessName": "keyword",
|
|
"DnsHostName" : "keyword",
|
|
"TaskName": "keyword",
|
|
"Status": "keyword"
|
|
}
|
|
},
|
|
"winlog.logon.type": "keyword",
|
|
"powershell.file.script_block_text": "text"
|
|
},
|
|
"filebeat-*": {
|
|
"o365.audit.NewValue": "keyword"
|
|
},
|
|
"logs-endpoint.events.*": {
|
|
"process.Ext.token.integrity_level_name": "keyword",
|
|
"process.parent.Ext.real.pid": "long",
|
|
"file.Ext.header_bytes": "keyword",
|
|
"file.Ext.entropy": "long",
|
|
"file.size": "long"
|
|
},
|
|
"logs-windows.*": {
|
|
"powershell.file.script_block_text": "text"
|
|
},
|
|
"logs-kubernetes.*": {
|
|
"kubernetes.audit.objectRef.resource": "keyword",
|
|
"kubernetes.audit.objectRef.subresource": "keyword",
|
|
"kubernetes.audit.verb": "keyword",
|
|
"kubernetes.audit.user.username": "keyword",
|
|
"kubernetes.audit.impersonatedUser.username": "keyword",
|
|
"kubernetes.audit.annotations.authorization_k8s_io/decision": "keyword",
|
|
"kubernetes.audit.annotations.authorization_k8s_io/reason": "keyword",
|
|
"kubernetes.audit.user.groups": "text",
|
|
"kubernetes.audit.requestObject.spec.containers.securityContext.privileged": "boolean",
|
|
"kubernetes.audit.requestObject.spec.containers.securityContext.allowPrivilegeEscalation": "boolean",
|
|
"kubernetes.audit.requestObject.spec.securityContext.runAsUser": "long",
|
|
"kubernetes.audit.requestObject.spec.containers.securityContext.runAsUser": "long",
|
|
"kubernetes.audit.requestObject.spec.hostPID": "boolean",
|
|
"kubernetes.audit.requestObject.spec.hostNetwork": "boolean",
|
|
"kubernetes.audit.requestObject.spec.hostIPC": "boolean",
|
|
"kubernetes.audit.requestObject.spec.volumes.hostPath.path": "keyword",
|
|
"kubernetes.audit.requestObject.spec.type": "keyword",
|
|
"kubernetes.audit.requestObject.rules.resources": "keyword",
|
|
"kubernetes.audit.requestObject.rules.verb": "keyword",
|
|
"kubernetes.audit.objectRef.namespace": "keyword",
|
|
"kubernetes.audit.objectRef.serviceAccountName": "keyword",
|
|
"kubernetes.audit.requestObject.spec.serviceAccountName": "keyword",
|
|
"kubernetes.audit.responseStatus.reason": "keyword",
|
|
"kubernetes.audit.requestObject.spec.containers.securityContext.capabilities.add": "keyword",
|
|
"kubernetes.audit.requestObject.spec.containers.image": "text"
|
|
}
|
|
}
|