Kubernetes Anonymous Request Authorized
This rule detects when an unauthenticated user request is authorized within the cluster. Attackers may attempt to use anonymous accounts to gain initial access to the cluster or to avoid attribution of their activities within the cluster. This rule excludes the /healthz, /livez and /readyz endpoints which are commonly accessed anonymously.
Elastic rule (View on GitHub)
1[metadata]
2creation_date = "2022/09/13"
3integration = ["kubernetes"]
4maturity = "production"
5min_stack_comments = "New fields added to Kubernetes Integration"
6min_stack_version = "8.4.0"
7updated_date = "2023/06/23"
8
9
10[rule]
11author = ["Elastic"]
12description = """
13This rule detects when an unauthenticated user request is authorized within the cluster. Attackers may attempt to use
14anonymous accounts to gain initial access to the cluster or to avoid attribution of their activities within the cluster.
15This rule excludes the /healthz, /livez and /readyz endpoints which are commonly accessed anonymously.
16"""
17false_positives = [
18 """
19 Anonymous access to the API server is a dangerous setting enabled by default. Common anonymous connections (e.g.,
20 health checks) have been excluded from this rule. All other instances of authorized anonymous requests should be
21 investigated.
22 """,
23]
24index = ["logs-kubernetes.*"]
25language = "kuery"
26license = "Elastic License v2"
27name = "Kubernetes Anonymous Request Authorized"
28note = """## Setup
29
30The Kubernetes Fleet integration with Audit Logs enabled or similarly structured data is required to be compatible with this rule."""
31references = [
32 "https://media.defense.gov/2022/Aug/29/2003066362/-1/-1/0/CTR_KUBERNETES_HARDENING_GUIDANCE_1.2_20220829.PDF",
33]
34risk_score = 47
35rule_id = "63c057cc-339a-11ed-a261-0242ac120002"
36severity = "medium"
37tags = ["Data Source: Kubernetes", "Tactic: Execution", "Tactic: Initial Access", "Tactic: Defense Evasion"]
38timestamp_override = "event.ingested"
39type = "query"
40
41query = '''
42event.dataset:kubernetes.audit_logs
43 and kubernetes.audit.annotations.authorization_k8s_io/decision:allow
44 and kubernetes.audit.user.username:("system:anonymous" or "system:unauthenticated" or not *)
45 and not kubernetes.audit.requestURI:(/healthz* or /livez* or /readyz*)
46'''
47
48
49[[rule.threat]]
50framework = "MITRE ATT&CK"
51[[rule.threat.technique]]
52id = "T1078"
53name = "Valid Accounts"
54reference = "https://attack.mitre.org/techniques/T1078/"
55[[rule.threat.technique.subtechnique]]
56id = "T1078.001"
57name = "Default Accounts"
58reference = "https://attack.mitre.org/techniques/T1078/001/"
59
60
61
62[rule.threat.tactic]
63id = "TA0001"
64name = "Initial Access"
65reference = "https://attack.mitre.org/tactics/TA0001/"
Setup
The Kubernetes Fleet integration with Audit Logs enabled or similarly structured data is required to be compatible with this rule.
References
Related rules
- File Made Executable via Chmod Inside A Container
- First Time Seen Google Workspace OAuth Login from Third-Party Application
- Kubernetes Container Created with Excessive Linux Capabilities
- Kubernetes Exposed Service Created With Type NodePort
- Kubernetes Pod Created With HostIPC