Container

Container Image ID

No

Osquery

Privileged Container

Yes

• Kubernetes

• Osquery

Reason

Yes

Kubernetes

Resource Name

Yes

Kubernetes

Role Actions

Yes

Kubernetes

Building Block

BB:CategoryDefinition: Resource Creation Events

Detects when components are created under critical namespaces, such as kube-system or kube-public. The namespace kube-system should only be used by objects created from Kubernetes system. The namespace kube-public is readable by all users, which must be used with caution.

Rule

Command Execution in Critical Namespaces by Non-System User

Detects execution of a command in a critical namespace, for example kube-system in Kerbernetes, by a non-system user. Normal users should not interact with system resources.

Note: Edit the rule to replace "system:serviceaccount" with typical service accounts on the system.

Rule

Creation of a Privileged Role for Container

Detects the creation of a privileged role. By default, it's defined as a role having access to all resources with all rights, or having create, update, or delete rights on "secrets" specifically.

Note: The rule response adds the role to the Privileged Role reference set. Adjust the AQL query to include any permission considered as Privileged.

Rule

Deletion of a Privileged Role for Container

Detects the deletion of a privileged role defined in the Privileged Role reference set.

Note: The rule response removes the role from the Privileged Role reference set.

Note: In JSA 7.3.2 and earlier versions, the reference set does not link properly to Privileged Roles - AlphaNumeric. This was corrected in 7.3.2 patch 1. If you do not have 7.3.2 patch 1 installed, you can do the following: Select the rule, and click Next. Under Rule Response, click the list for the reference set, and select Privileged Roles - AlphaNumeric.

Rule

Multiple Sensitive Resources Deleted

Detects when multiple sensitive resources are being deleted. This may indicate an intruder is compromising sensitive information.

Note: The Sensitive Resource Names reference map of sets must be populated with the relevant names.

Rule

Remote Shell Execution to a Container Detected

Detects remote shell execution. An adversary might use this technique to execute arbitrary commands on a server. This could affect applications and data, and allow to pivot to other systems within the organization.

Privileged Roles and Users for Container

Shows privileged roles and users from Kubernetes.

The report content is collated by using the following Log Activity searches:

• Privileged Roles for Container

• Privileged Users for Container

Note: Edit this search and any relevant search dependencies to refine the results.

Reference Map of Sets

Sensitive Resource Names

Lists all sensitive resource names per resource type.

Privileged Roles for Container

Shows all privileged roles for containers.

File Directory

Yes

• Cisco AMP

• Cisco Firepower

• Linux

• Microsoft Office 365

• Microsoft Windows

• Osquery

• Windows Defender ATP

GroupID

Yes

• Linux

• Microsoft Windows

• Osquery

Parent Process Path

Yes

• Osquery

• Microsoft Windows

Process CommandLine

Yes

• Carbon Black Response

• Kubernetes

• Microsoft Windows

• Osquery

• Sysmon

Rule Details

Yes

Osquery

Source Mount Point

Yes

Osquery

User ID

Yes

• Linux

• Osquery

Building Block

BB:BehaviourDefinition: Abnormal Right Assigned followed by Privileged Container Creation

Used to track Privilege Modification followed by Suspicious Activity.

Building Block

BB:DeviceDefinition: Operating System

Defines all operating systems on the system.

Rule

Abnormal Rights Assigned to Unauthorized Users

Detects an unusual sudo rule added in the system. The Target User Name is the user whom the sudoer rule was applied to.

Note: Edit this rule to replace authorized_username with the list of typical administrators of the system, and utilities with file modification or execution capabilities.

Rule

Creation of a User with Superuser Privileges

Detects the creation of a user account that has a uid or gid of 0, which indicates a Superuser.

Rule

Hostile Process Detected in a Container

Detects processes that are categorized as hostile, such as malware, phishing, cryptomining.

Note: The Malware Hashes SHA reference set must be populated. You can use the Threat Intelligence App to import threat intel feeds into that reference set.

Rule

Modification to Authorized Keys File

Detects when the /.ssh/authorized_keys file is modified. The attacker adds their Public Key to the authorized_keys file, which allows them login to the system anytime without further authentication if they have their Private Key.

Rule

No Password Rule Added to Sudoers File

Detects an unusual sudo rule added in the system, which requires no password for a user.

Note: Edit the rule to replace authorized_username with the list of authorized administrators of the system.

Rule

Reverse or Bind Shell Detected

Detects any reverse or bind shell. This is a shell connection that is initiated from the target host to the attacker host.

Reference Set

Malware Hashes SHA

Lists all malware SHA hashes for processes.

Reference Set

Sensitive Container IDs

Lists all sensitive container IDs (must be populated by the user).

Reference Set

Whitelisted Linux Processes

Lists all whitelisted Linux processes that are authorized to perform actions on critical files.