{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3amicrosoftazure_kubernetes_service/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:microsoft:azure_kubernetes_service:*:*:*:*:*:*:*:*"],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Azure Kubernetes Service"],"_cs_severities":["medium"],"_cs_tags":["cloud","kubernetes","azure","discovery","monitoring"],"_cs_type":"advisory","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eThis rule monitors Azure Kubernetes Service (AKS) \u003ccode\u003ekube-audit\u003c/code\u003e logs to identify reconnaissance behavior. It specifically tracks identities that access multiple Kubernetes API resource types - such as namespaces, nodes, pods, roles, clusterroles, configmaps, serviceaccounts, rolebindings, and clusterrolebindings - within a single window. By focusing on the cardinality of unique resources accessed, the logic differentiates cluster orientation and reconnaissance from steady-state controllers or platform-managed identities.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful reconnaissance allows an adversary to map the cluster environment, identify high-value targets, and understand RBAC structures, which are critical precursors to privilege escalation or lateral movement within the containerized environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the provided Elastic ESQL detection rule to identify anomalous multi-resource enumeration in AKS clusters.\u003c/li\u003e\n\u003cli\u003eEstablish a baseline of legitimate CI/CD, GitOps, and backup operations to exclude expected service account activity and reduce false positives.\u003c/li\u003e\n\u003cli\u003eReview the identities (\u003ccode\u003eEsql.username\u003c/code\u003e) and user agents (\u003ccode\u003eEsql.user_agent\u003c/code\u003e) identified by this rule for potential credential compromise, especially those involving \u003ccode\u003ekubectl\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eEnsure AKS diagnostic logs, specifically the \u003ccode\u003ekube-audit\u003c/code\u003e category, are correctly routed through Event Hubs to the monitoring environment.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-21T13:59:01Z","date_published":"2026-10-21T13:59:01Z","id":"https://feed.craftedsignal.io/briefs/2026-10-azure-aks-discovery/","summary":"This detection identifies potential reconnaissance activity in Azure Kubernetes Service (AKS) by flagging identities that enumerate three or more distinct Kubernetes API resource types within a short timeframe.","title":"Azure Kubernetes Service: Multi-resource discovery detection","url":"https://feed.craftedsignal.io/briefs/2026-10-azure-aks-discovery/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:microsoft:azure_kubernetes_service:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}