kubernetes.yml

AnalysisType: pack
PackID: PantherManaged.Kubernetes.Core
DisplayName: "Panther Core Kubernetes Pack"
Description: This is a group of detections that act on Kubernetes logs sourced from Amazon EKS.
PackDefinition:
  IDs:
    # Kubernetes scheduled queries and rules
    - Kubernetes.CronJobCreatedOrModified
    - Kubernetes.DaemonSetDeployed
    - Kubernetes.IOCActivity
    - Kubernetes.NewAdmissionControllerCreated
    - Kubernetes.OverlyPermissivePod
    - Kubernetes.PodAttachedHostNetwork
    - Kubernetes.PodCreatedDefaultNameSpace
    - Kubernetes.PodHostPathVolumeMount
    - Kubernetes.PodUsingHostPIDNamespace
    - Kubernetes.PodUsingIPCNamespace
    - Kubernetes.PrivilegedPodCreated
    - Kubernetes.SecretEnumeration
    - Kubernetes.ServiceTypeNodePortDeployed
    - Kubernetes.UnauthenticatedAPIRequest
    - Kubernetes.UnauthorizedPodExecution
    # Queries
    - IOC Activity in K8 Control Plane
    - Kubernetes Cron Job Created or Modified
    - Kubernetes Pod Created in Pre-Configured or Default Name Spaces
    - Kubernetes Service with Type Node Port Deployed
    - New Admission Controller Created
    - New DaemonSet Deployed to Kubernetes
    - Pod Created or Modified Using the Host IPC Namespace
    - Pod Created or Modified Using the Host PID Namespace
    - Pod Created with Overly Permissive Linux Capabilities
    - Pod attached to the Node Host Network
    - Pod creation or modification to a Host Path Volume Mount
    - Privileged Pod Created
    - Secret Enumeration by a User
    - Unauthenticated Kubernetes API Request
    - Unauthorized Kubernetes Pod Execution