GCP K8s IOCActivity

AnalysisType: rule
RuleID: "GCP.K8s.IOC.Activity"
DisplayName: "GCP K8s IOCActivity"
Enabled: false
Status: Deprecated
Filename: gcp_k8s_ioc_activity.py
LogTypes:
  - GCP.AuditLog
Tags:
  - Deprecated
  - GCP
  - Optional
  - Encrypted Channel - Asymmetric Cryptography
  - Command and Control
Severity: Medium
Description: This detection monitors for any kubernetes API Request originating from an Indicator of Compromise.
Reports:
  MITRE ATT&CK:
    - TA0011:T1573.002 # Encrypted Channel: Asymmetric Cryptography
Runbook: Add IP address the request is originated from to banned addresses.
Reference: https://medium.com/snowflake/from-logs-to-detection-using-snowflake-and-panther-to-detect-k8s-threats-d72f70a504d7
Tests:
  - Name: triggers
    ExpectedResult: true
    Log:
      {
        "operation": { "producer": "k8s.io" },
        "p_enrichment": { "tor_exit_nodes": ["1.1.1.1"] },
      }
  - Name: ignore
    ExpectedResult: false
    Log:
      {
        "operation": { "producer": "chrome" },
        "p_enrichment": { "tor_exit_nodes": ["1.1.1.1"] },
      }


# ------ paired body: gcp_k8s_ioc_activity.py ------

from panther_gcp_helpers import gcp_alert_context


def rule(event):
    if event.deep_get("operation", "producer") == "k8s.io" and event.deep_get(
        "p_enrichment", "tor_exit_nodes"
    ):
        return True
    return False


def title(event):
    actor = event.deep_get(
        "protoPayload", "authenticationInfo", "principalEmail", default="<ACTOR_NOT_FOUND>"
    )
    operation = event.deep_get("protoPayload", "methodName", default="<OPERATION_NOT_FOUND>")
    project_id = event.deep_get("resource", "labels", "project_id", default="<PROJECT_NOT_FOUND>")

    return f"[GCP]: [{actor}] performed [{operation}] on project [{project_id}]"


def alert_context(event):
    context = gcp_alert_context(event)
    context["tor_exit_nodes"] = event.deep_get("p_enrichment", "tor_exit_nodes")
    return context