| ID | Technique | Tactic |
|---|---|---|
| T1526 | Cloud Service Discovery | Discovery |
Detection: GCP Kubernetes cluster scan detection
REMOVED DETECTION
This detection has been removed from the Splunk Threat Research content library and is no longer maintained or supported.
Reason: Detections updated to use the new search logic and field names due to the TA update
Removed in version: 5.2.0
Replacement: Kubernetes Scanning by Unauthenticated IP Address
If you have any questions or concerns, please reach out to us at research@splunk.com.
Description
This search provides information of unauthenticated requests via user agent, and authentication data against Kubernetes cluster
Search
1`google_gcp_pubsub_message` data.protoPayload.requestMetadata.callerIp!=127.0.0.1 data.protoPayload.requestMetadata.callerIp!=::1 "data.labels.authorization.k8s.io/decision"=forbid "data.protoPayload.status.message"=PERMISSION_DENIED data.protoPayload.authenticationInfo.principalEmail="system:anonymous"
2| rename data.protoPayload.requestMetadata.callerIp as src_ip
3| stats count min(_time) as firstTime max(_time) as lastTime values(data.protoPayload.methodName) as method_name values(data.protoPayload.resourceName) as resource_name values(data.protoPayload.requestMetadata.callerSuppliedUserAgent) as http_user_agent by src_ip data.resource.labels.cluster_name
4| rename data.resource.labels.cluster_name as cluster_name
5| `security_content_ctime(lastTime)`
6| `security_content_ctime(firstTime)`
7| `gcp_kubernetes_cluster_scan_detection_filter`
Data Source
No data sources specified for this detection.
Macros Used
| Name | Value |
|---|---|
| google_gcp_pubsub_message | sourcetype="google:gcp:pubsub:message" |
| gcp_kubernetes_cluster_scan_detection_filter | `` |
gcp_kubernetes_cluster_scan_detection_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Annotations
MITRE ATT&CK
Kill Chain Phases
NIST
CIS
Threat Actors
Default Configuration
This detection is configured by default in Splunk Enterprise Security to run with the following settings:
| Setting | Value |
|---|---|
| Disabled | true |
| Cron Schedule | N/A |
| Earliest Time | N/A |
| Latest Time | N/A |
| Schedule Window | N/A |
| Creates Finding (Notable) | No |
| Creates Intermediate Finding (Risk Event) | No |
TTP detections generate a Finding (Notable) and may generate Intermediate Findings (Risk Events) for associated entities.
Implementation
You must install the GCP App for Splunk (version 2.0.0 or later), then configure stackdriver and set a Pub/Sub subscription to be imported to Splunk. You must also install Cloud Infrastructure data model.Customize the macro kubernetes_gcp_scan_fingerprint_attack_detection to filter out FPs.
Known False Positives
Not all unauthenticated requests are malicious, but frequency, User Agent and source IPs will provide context.
Associated Analytic Story
Detection Testing
| Test Type | Status | Dataset | Source | Sourcetype |
|---|---|---|---|---|
| Validation | Not Applicable | N/A | N/A | N/A |
| Unit | Not Applicable | N/A | N/A |
N/A |
| Integration | Not Applicable | N/A | N/A |
N/A |
Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
Source: GitHub |
Version: 4