LoFP
/
azure aks kubernetes cluster
Title
Tags
not all rbac authorications are malicious. rbac authorizations can uncover malicious activity specially if sensitive roles have been granted.
azure aks kubernetes cluster
aws eks kubernetes cluster
gcp gke kubernetes cluster
splunk
not all unauthenticated requests are malicious, but source ips, useragent, verb, request uri and response status will provide context.
t1526
azure aks kubernetes cluster
splunk
sensitive object access is not necessarily malicious but user and object context can provide guidance for detection.
gcp gke kubernetes cluster
aws eks kubernetes cluster
azure aks kubernetes cluster
splunk
this search can give false positives as there might be inherent issues with authentications and permissions at cluster.
azure aks kubernetes cluster
gcp gke kubernetes cluster
aws eks kubernetes cluster
splunk