Sensitive namespace modified using kubectl

Classification:

attack

Tactic:

Technique:

이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Goal

Detect the use of kubectl inside a container to modify the ConfigMap of a sensitive namespace.

This detection triggers when kubectl is executed with specific arguments related to modifying the ConfigMap of a sensitive namespace.

Identify the purpose of the configuration being applied, and determine if it is authorized.
If it is not authorized, identify and revoke the credential used to authenticate to the Kubernetes API.
Initiate the incident response process.
Remediate compromised resources and repair the root cause.

A kubectl command was used to modify a ConfigMap in a sensitive namespace, potentially to alter cluster configuration or inject malicious settings.

Requires Agent version 7.27 or greater