cscli scenarios install crowdsecurity/k8s-audit-pod-execDetects execution (via kubectl exec) in pods.
The scenario needs logs from the pods resources at the Metadata level at a minimum.
No decision will be taken based on this scenario, it is only intended for notification purposes.
1type: trigger2name: crowdsecurity/k8s-audit-pod-exec3description: "Detect execution (via kubectl exec) in pods"4filter: |5 evt.Meta.log_type == 'k8s-audit' &&6 (7 (evt.Meta.datasource_type == "k8s-audit" && evt.Unmarshaled.k8s_audit.ObjectRef?.Resource == 'pods' && evt.Unmarshaled.k8s_audit.ObjectRef?.Subresource == 'exec')8 ||9 (evt.Meta.datasource_type != "k8s-audit" && evt.Unmarshaled.k8s_audit.objectRef?.resource == 'pods' && evt.Unmarshaled.k8s_audit.objectRef?.subresource == 'exec')10 )11labels:12 notification: true13 classification:14 - attack.T160915 behavior: "k8s:audit"16 label: "Kubernetes Exec Into Pod"17 spoofable: 018 confidence: 319 cti: false20 service: k8s21