EKS Audit Log based single sourceIP is generating multiple 403s

Description

This detection identifies if a public sourceIP is generating multiple 403s with the Kubernetes API server.

Query · python

from ipaddress import ip_address

from panther_aws_helpers import eks_panther_obj_ref


# Alert if
#   state is ResponseComplete
#   sourceIPs[0] is a Public Address
#   responseStatus:code == 403
def rule(event):
    if event.get("stage", "") != "ResponseComplete":
        return False
    # We include only 403
    if event.get("responseStatus", {}).get("code", 0) != 403:
        return False
    # And we only want things that might naively be kubernetes api endpoints
    # we do not want to alert on scanners casting non-kubernetes requests.
    if not event.get("requestURI", "").startswith(("/api/", "/apis/")):
        return False
    p_eks = eks_panther_obj_ref(event)
    if not ip_address(p_eks.get("sourceIPs")[0]).is_global:
        return False
    return True


# If not defined, defaults to the rule display name or rule ID.
def title(event):
    p_eks = eks_panther_obj_ref(event)
    return (
        f"[{p_eks.get('sourceIPs')[0]}] received [403] "
        f"when executing [{p_eks.get('verb')}] "
        f"for resource [{p_eks.get('resource')}] "
        f"in ns [{p_eks.get('ns')}] on "
        f"[{p_eks.get('p_source_label')}] as "
        f"[{p_eks.get('actor')}]"
    )


def dedup(event):
    p_eks = eks_panther_obj_ref(event)
    return f"{p_eks.get('p_source_label')}_403_{p_eks.get('sourceIPs')[0]}"


def alert_context(event):
    p_eks = eks_panther_obj_ref(event)
    mutable_event = event.to_dict()
    mutable_event["p_eks"] = p_eks
    return dict(mutable_event)

Detection tier

Atomic IOCs
Network & Host Artifacts
Tools
TTPs
Pending classification

Metadata

Source: panther-labs/panther-analysis
License: Apache 2.0
Severity: Informational
Status: Stable
Query type: python
Created: 2022-12-01
Modified: 2024-04-02
Authored by: panther-labs
Source ID
Upstream: rules/aws_eks_rules/source_ip_multiple_403.yml
Type: rule
Version: 1
References: https://aws.github.io/aws-eks-best-practices/security/docs/detective/
Data sources: Amazon.EKS.Audit

ATT&CK

TA0007 T1613