What happened

The process {{ @process.comm }} made a DNS request for {{ @dns.question.name }}, potentially for enumeration.

Goal

Detect the use of an internal DNS query to any.any.svc.cluster.local.

Strategy

This detection triggers when a DNS query is requested for any.any.svc.cluster.local, which returns all Service DNS records and the corresponding IP. The information can be further leveraged for additional discovery and enumeration.

Triage and response

1. Identify the purpose of the container using tags, such as the image and service tags.
2. Determine if any of the targets of the enumeration have additional discovery performed.
3. Initiate the incident response process.
4. Remediate compromised resources and repair the root cause.

Requires Agent version 7.36 or greater