Merge pull request #860 from splunk/kubernetes-unauthorized-access

Kubernetes unauthorized access
splunk · Dec 7, 2023 · 283f3ed · 283f3ed
2 parents 26251e9 + 9f2859c
commit 283f3ed
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 0 deletions.
diff --git a/...ttack_techniques/T1204/kubernetes_unauthorized_access/kubernetes_unauthorized_access.json b/...ttack_techniques/T1204/kubernetes_unauthorized_access/kubernetes_unauthorized_access.json
diff --git a/...attack_techniques/T1204/kubernetes_unauthorized_access/kubernetes_unauthorized_access.yml b/...attack_techniques/T1204/kubernetes_unauthorized_access/kubernetes_unauthorized_access.yml
@@ -0,0 +1,11 @@
+author: Patrick Bareiss
+id: 4db6594e-9e8c-4223-8681-262d06b4b4d3
+date: '2023-12-07'
+description: Kubernetes audit logs which contains a forbidden access to a namespace.
+environment: attack_range
+dataset:
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204/kubernetes_unauthorized_access/kubernetes_unauthorized_access.json
+sourcetypes:
+- aws:cloudwatchlogs
+references:
+- https://attack.mitre.org/techniques/T1204