Kubernetes DNS enumeration

Classification:

attack

Tactic:

TA0007-discovery

Technique:

T1046-network-service-discovery

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Goal

Detect the use of an internal DNS query to any.any.svc.cluster.local.

Strategy

This detection triggers when a DNS query is requested for any.any.svc.cluster.local, which returns all Service DNS records and the corresponding IP. The information can be further leveraged for additional discovery and enumeration.

Triage and response

  1. Identify the purpose of the container using tags, such as the image and service tags.
  2. Determine if any of the targets of the enumeration have additional discovery performed.
  3. Initiate the incident response process.
  4. Remediate compromised resources and repair the root cause.

Requires Agent version 7.36 or greater