Unusual Source IP for Azure Arc Cluster Credential Access

This detection identifies anomalous access patterns to Azure Arc-connected Kubernetes clusters. Specifically, it monitors the listClusterUserCredential operation, which provides credentials for the Arc Cluster Connect proxy, enabling kubectl access through the Azure ARM API. An attacker leveraging stolen credentials, such as those belonging to a service principal, may attempt to list cluster credentials from an unfamiliar IP address. The detection leverages a 7-day history to establish baseline IP-to-identity mappings, reducing false positives from legitimate sources like CI/CD pipelines with rotating IPs. This activity is particularly relevant because successful credential access can lead to unauthorized cluster access and potential data exfiltration or resource compromise. The IBM X-Force has identified potential abuse of Azure Arc for hybrid escalation and persistence. The detection logic originates from Elastic's detection rules.

Attack Chain

1. Attacker compromises a service principal or user account with privileges to manage Azure Arc-connected Kubernetes clusters.
2. Attacker authenticates to Azure using the compromised credentials.
3. Attacker invokes the MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/LISTCLUSTERUSERCREDENTIAL/ACTION operation via the Azure API from a new or unusual source IP address.
4. The operation returns credentials for the Arc Cluster Connect proxy.
5. Attacker uses the retrieved credentials to establish a proxy tunnel via az connectedk8s proxy.
6. Attacker routes kubectl commands through the Azure ARM API, accessing the Kubernetes cluster without direct network connectivity.
7. Attacker performs reconnaissance within the Kubernetes cluster, identifying valuable resources like secrets and configmaps.
8. Attacker exfiltrates sensitive data or compromises the cluster's integrity.

Impact

A successful attack can lead to unauthorized access to Kubernetes clusters connected to Azure Arc. Compromised credentials can enable attackers to perform arbitrary actions within the cluster, potentially leading to data theft, service disruption, or the deployment of malicious workloads. The severity depends on the privileges associated with the compromised identity and the sensitivity of the data stored within the cluster. Lateral movement from compromised cloud resources to on-premise Kubernetes clusters is possible.

Recommendation

• Deploy the Sigma rule "Azure Arc Cluster Credential Access from Unusual Source" to your SIEM and tune the history window for your environment.
• Investigate any alerts generated by the Sigma rule by examining the caller identity (azure.activitylogs.identity.claims.appid), source IP (source.ip), and associated Azure Sign-In Logs.
• If a compromise is suspected, revoke the service principal credentials and remove Arc RBAC role assignments as detailed in the investigation guide.
• Monitor Azure Activity Logs for MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/LISTCLUSTERUSERCREDENTIAL/ACTION events, filtering for unexpected source IPs.
• Review Kubernetes audit logs for suspicious activity following the listClusterUserCredential operation.