Kubernetes API Bruteforce Detection Scenario by crowdsecurity | CrowdSec Hub

Kubernetes API Bruteforce

Attack scenariok8s:bruteforceMITRE T1110

By: crowdsecurity
Version: 0.5
Name: crowdsecurity/k8s-audit-api-server-bruteforce
Remediation: Ban

Detect bruteforce attempts against K8S API server

Install with a top-level collection

1 collection include it

sudo cscli collections install crowdsecurity/k8s-audit

Installs 1 parser and 7 scenarios.

View Kubernetes - Audit Detection →

Installation

sudo cscli scenarios install crowdsecurity/k8s-audit-api-server-bruteforce

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/k8s-audit-api-server-bruteforce.yaml· 25 linesGitHub

1type: leaky1
2name: crowdsecurity/k8s-audit-api-server-bruteforce
3description: "Detect bruteforce attempts against K8S API server"
4filter: |2
5  evt.Meta.log_type == 'k8s-audit' && 
6  (
7   (evt.Meta.datasource_type == "k8s-audit" && evt.Unmarshaled.k8s_audit.ResponseStatus.code in [401, 403])
8   ||
9   (evt.Meta.datasource_type != "k8s-audit" && evt.Unmarshaled.k8s_audit.responseStatus.code in [401, 403])
10  )
11leakspeed: "10s"3
12capacity: 54
13groupby: evt.Meta.source_ip5
14blackhole: 1m6
15reprocess: true
16labels:
17  remediation: true7
18  classification:8
19    - attack.T1110
20  behavior: "k8s:bruteforce"
21  intent: reconnaissance
22  label: "Kubernetes API Bruteforce"
23  spoofable: 0
24  confidence: 3
25  service: k8s

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Detects bruteforce attempts against the K8S API server.

This scenario needs the K8S audit logs to work.