Kubernetes DNS enumeration
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、
お気軽にご連絡ください。
Goal
Detect the use of an internal DNS query to any.any.svc.cluster.local
.
Strategy
This detection triggers when a DNS query is requested for any.any.svc.cluster.local
, which returns all Service DNS records and the corresponding IP. The information can be further leveraged for additional discovery and enumeration.
Triage and response
- Identify the purpose of the container using tags, such as the image and service tags.
- Determine if any of the targets of the enumeration have additional discovery performed.
- Initiate the incident response process.
- Remediate compromised resources and repair the root cause.
Requires Agent version 7.36 or greater