Kubernetes Scanning Activity

• GCP Kubernetes cluster pod scan detection :
  threat GCP Kubernetes cluster None version:8
  The following analytic identifies unauthenticated requests to Kubernetes cluster pods. It detects this activity by analyzing GCP Pub/Sub messages for audit logs where the response status code is 401, indicating unauthorized access attempts. This activity is significant for a SOC because it may indicate reconnaissance or scanning attempts by an attacker trying to identify vulnerable pods. If confirmed malicious, this activity could lead to unauthorized access, allowing the attacker to exploit vulnerabilities within the cluster, potentially compromising sensitive data or gaining control over the Kubernetes environment.


• Amazon EKS Kubernetes cluster scan detection :
  threat Amazon EKS Kubernetes cluster None version:7
  The following analytic detects unauthenticated requests to an Amazon EKS Kubernetes cluster, specifically identifying actions by the "system:anonymous" user. It leverages AWS CloudWatch Logs data, focusing on user agents and authentication details. This activity is significant as it may indicate unauthorized scanning or probing of the Kubernetes cluster, which could be a precursor to an attack. If confirmed malicious, this could lead to unauthorized access, data exfiltration, or disruption of services within the Kubernetes environment.


• Kubernetes Azure pod scan fingerprint :
  threat Azure AKS Kubernetes cluster 2024-11-14 version:4
  This search provides information of unauthenticated requests via source IP user agent, request URI and response status data against Kubernetes cluster pod in Azure


• Kubernetes Azure scan fingerprint :
  threat Azure AKS Kubernetes cluster 2024-11-14 version:4
  This search provides information of unauthenticated requests via source IP user agent, request URI and response status data against Kubernetes cluster in Azure


• GCP Kubernetes cluster scan detection :
  threat GCP Kubernetes cluster 2024-11-14 version:4
  This search provides information of unauthenticated requests via user agent, and authentication data against Kubernetes cluster


• Amazon EKS Kubernetes Pod scan detection :
  threat Amazon EKS Kubernetes cluster Pod None version:7
  The following analytic detects unauthenticated requests made against the Kubernetes Pods API, indicating potential unauthorized access attempts. It leverages the `aws_cloudwatchlogs_eks` data source, filtering for events where `user.username` is "system:anonymous", `verb` is "list", and `objectRef.resource` is "pods", with `requestURI` set to "/api/v1/pods". This activity is significant as it may signal attempts to access sensitive resources or execute unauthorized commands within the Kubernetes environment. If confirmed malicious, such access could lead to data compromise, unauthorized command execution, or lateral movement within the cluster.