1type: leaky
2name: crowdsecurity/k8s-audit-api-server-bruteforce
3description: "Detect bruteforce attempts against K8S API server"
4filter: |
5  evt.Meta.log_type == 'k8s-audit' && 
6  (
7   (evt.Meta.datasource_type == "k8s-audit" && evt.Unmarshaled.k8s_audit.ResponseStatus.code in [401, 403])
8   ||
9   (evt.Meta.datasource_type != "k8s-audit" && evt.Unmarshaled.k8s_audit.responseStatus.code in [401, 403])
10  )
11leakspeed: "10s"
12capacity: 5
13groupby: evt.Meta.source_ip
14blackhole: 1m
15reprocess: true
16labels:
17  remediation: true
18  classification:
19    - attack.T1110
20  behavior: "k8s:bruteforce"
21  label: "Kubernetes API Bruteforce"
22  spoofable: 0
23  confidence: 3
24  service: k8s
25