LoFP LoFP / approved automation, platform controllers, or gitops may update the coredns configmap (for example custom forward rules). validate the identity and change window, and add exclusions for verified service accounts.

Techniques

Sample rules

Azure AKS CoreDNS or Kube-DNS Configuration Modified

Description

Detects an identity creating or modifying the CoreDNS or kube-dns ConfigMap in the kube-system namespace on AKS (Azure Kubernetes Service), excluding known AKS control-plane and platform identities. Rewriting cluster DNS (by editing coredns/kube-dns or creating and editing coredns-custom) enables cluster-wide adversary-in-the-middle by redirecting internal service resolution to attacker-controlled IPs, allowing credential capture and traffic interception. Coverage includes workload service accounts (system:serviceaccount:*), so a compromised in-cluster token is not excluded.

Detection logic

data_stream.dataset:azure.platformlogs and
  event.action:"Microsoft.ContainerService/managedClusters/diagnosticLogs/Read" and
  azure.platformlogs.category:("kube-audit" or "kube-audit-admin") and
  azure.platformlogs.properties.log.stage:"ResponseComplete" and
  azure.platformlogs.properties.log.objectRef.resource:"configmaps" and
  azure.platformlogs.properties.log.objectRef.namespace:"kube-system" and
  azure.platformlogs.properties.log.objectRef.name:("coredns" or "kube-dns" or "coredns-custom") and
  azure.platformlogs.properties.log.verb:("create" or "update" or "patch" or "delete") and
  not azure.platformlogs.properties.log.user.username:(
    system\:node\:* or "aksService" or "hcpService" or "readinessChecker" or
    system\:serviceaccount\:kube-system\:*
  )