Contact K8S API Server From Container

Description

Detect attempts to communicate with the K8S API Server from a container by non-profiled users. Kubernetes APIs play a pivotal role in configuring the cluster management lifecycle. Detecting potential unauthorized access to the API server is of utmost importance. Audit your complete infrastructure and pinpoint any potential machines from which the API server might be accessible based on your network layout. If Falco can't operate on all these machines, consider analyzing the Kubernetes audit logs (typically drained from control nodes, and Falco offers a k8saudit plugin) as an additional data source for detections within the control plane.

Query · falco

evt.type=connect and (fd.typechar=4 or fd.typechar=6) and container and k8s_api_server and not k8s_containers and not user_known_contact_k8s_api_server_activities

Rule dependencies

Depends on

  • composes · Falco macro container
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro k8s_api_server
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro k8s_containers
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro user_known_contact_k8s_api_server_activities
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Unexpected connection to K8s API Server from container | connection=%fd.name lport=%fd.lport rport=%fd.rport fd_type=%fd.type fd_proto=%fd.l4proto evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source Contact K8S API Server From Container · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Contact K8S API Server From Container
desc: 'Detect attempts to communicate with the K8S API Server from a container by
  non-profiled users. Kubernetes APIs play a pivotal role in configuring the cluster
  management lifecycle. Detecting potential unauthorized access to the API server
  is of utmost importance. Audit your complete infrastructure and pinpoint any potential
  machines from which the API server might be accessible based on your network layout.
  If Falco can''t operate on all these machines, consider analyzing the Kubernetes
  audit logs (typically drained from control nodes, and Falco offers a k8saudit plugin)
  as an additional data source for detections within the control plane.

  '
condition: 'evt.type=connect and (fd.typechar=4 or fd.typechar=6) and container and
  k8s_api_server and not k8s_containers and not user_known_contact_k8s_api_server_activities

  '
output: Unexpected connection to K8s API Server from container | connection=%fd.name
  lport=%fd.lport rport=%fd.rport fd_type=%fd.type fd_proto=%fd.l4proto evt_type=%evt.type
  user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name
  proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty
priority: NOTICE
tags:
- maturity_stable
- container
- network
- k8s
- mitre_discovery
- T1565

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.