Kubernetes DNS enumeration

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.


Detect the use of an internal DNS query to any.any.svc.cluster.local.


This detection triggers when a DNS query is requested for any.any.svc.cluster.local, which returns all Service DNS records and the corresponding IP. The information can be further leveraged for additional discovery and enumeration.

Triage and response

  1. Identify the purpose of the container using tags, such as the image and service tags.
  2. Determine if any of the targets of the enumeration have additional discovery performed.
  3. Initiate the incident response process.
  4. Remediate compromised resources and repair the root cause.

Requires Agent version 7.36 or greater