Kubernetes DNS enumeration

Classification:

attack

Tactic:

TA0007-discovery

Technique:

T1046-network-service-discovery

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Goal

Detect the use of an internal DNS query to any.any.svc.cluster.local.

Strategy

This detection triggers when a DNS query is requested for any.any.svc.cluster.local, which returns all Service DNS records and the corresponding IP. The information can be further leveraged for additional discovery and enumeration.

Triage and response

  1. Identify the purpose of the container using tags, such as the image and service tags.
  2. Determine if any of the targets of the enumeration have additional discovery performed.
  3. Initiate the incident response process.
  4. Remediate compromised resources and repair the root cause.

Requires Agent version 7.36 or greater