Kubernetes API anonymous access
Attack scenariok8s:scanMITRE T1595
- Version
- 0.4
- Name
- crowdsecurity/k8s-audit-anonymous-access
Detect allowed anonymous access to the K8S API
Install with a top-level collection
1 collection include itsudo cscli collections install crowdsecurity/k8s-auditInstalls 1 parser and 7 scenarios.
View Kubernetes - Audit Detection →Installation
sudo cscli scenarios install crowdsecurity/k8s-audit-anonymous-accessThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
type: triggername: crowdsecurity/k8s-audit-anonymous-accessdescription: "Detect allowed anonymous access to the K8S API"filter: |evt.Meta.log_type == 'k8s-audit' &&((evt.Meta.datasource_type == "k8s-audit" && evt.Unmarshaled.k8s_audit.ObjectRef?.Resource not in ["healthz", "livez", "readyz"])||(evt.Meta.datasource_type != "k8s-audit" && evt.Unmarshaled.k8s_audit.objectRef?.resource not in ["healthz", "livez", "readyz"]))&& evt.Meta.user in ["system:anonymous", "system:unauthenticated"]labels:notification: trueclassification:- attack.T1595behavior: "k8s:scan"label: "Kubernetes API anonymous access"spoofable: 0service: k8sconfidence: 3
Installed on
Know where it runs
Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.
Documentation
Detects anonymous access to the K8S API, using the cluster audit logs.
Only attempts done on resources that are logged at least at the Metadata level will be recorded.
Access to healthz, livez and readyz are ignored.
No decision will be taken based on this scenario, it is only intended for notification purposes.