Kubernetes Azure pod scan fingerprint

Name:Kubernetes Azure pod scan fingerprint
id:86aad3e0-732f-4f66-bbbc-70df448e461d
version:4
date:2024-11-14
author:Rod Soto, Splunk
status:deprecated
type:Hunting
Description:This search provides information of unauthenticated requests via source IP user agent, request URI and response status data against Kubernetes cluster pod in Azure
Data_source:

search:`kubernetes_azure` category=kube-audit
| spath input=properties.log
| search responseStatus.code=401
| table sourceIPs{} userAgent verb requestURI responseStatus.reason properties.pod |`kubernetes_azure_pod_scan_fingerprint_filter`

how_to_implement:You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics
known_false_positives:Not all unauthenticated requests are malicious, but source IPs, userAgent, verb, request URI and response status will provide context.
References:
drilldown_searches:
  :
analytic_story:['Kubernetes Scanning Activity']

asset_type:Azure AKS Kubernetes cluster

mitre_attack_id:NULL

product:None

category:None

security_domain:threat

tags:
  analytic_story:
    - 'Kubernetes Scanning Activity'
  asset_type:Azure AKS Kubernetes cluster
  product:
    - 'Splunk Enterprise'
    - 'Splunk Enterprise Security'
    - 'Splunk Cloud'
  security_domain:threat

tests:
  :
manual_test:None