Azure Kubernetes Services - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/azure-kubernetes-services/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 02 Jan 2024 15:00:00 +0000Azure Kubernetes Services (AKS) Kubernetes Rolebindings Createdhttps://feed.craftedsignal.io/briefs/2024-01-aks-rolebinding-created/Tue, 02 Jan 2024 15:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-aks-rolebinding-created/The creation of role binding or cluster role bindings in Azure Kubernetes Services (AKS) can indicate privilege escalation by an adversary creating a binding to the cluster-admin ClusterRole or other high-privilege roles.This detection rule identifies the creation of role binding or cluster role bindings in Azure Kubernetes Services (AKS) by monitoring Azure activity logs for successful creation events. These role bindings assign roles to Kubernetes subjects, like users, groups, or service accounts. An attacker who has permissions to create bindings and cluster-bindings can escalate privileges by creating a binding to the cluster-admin ClusterRole or other high privileges roles. This activity is logged within Azure and can be detected using the Azure Activity Logs. This activity can lead to complete control of the Kubernetes cluster and its resources if a cluster-admin role is bound to a malicious actor.

Attack Chain

  1. The attacker gains initial access to an Azure account with sufficient permissions to interact with AKS and create role bindings.
  2. The attacker enumerates available roles and cluster roles within the AKS cluster.
  3. The attacker identifies high-privilege roles, such as cluster-admin, which would grant extensive control over the cluster.
  4. The attacker creates a new RoleBinding or ClusterRoleBinding, associating the target user/group/service account with the high-privilege role. The Azure activity logs capture this event.
  5. The attacker validates the successful creation of the role binding.
  6. The attacker (or the user/group/service account targeted) leverages the newly granted privileges to perform unauthorized actions within the AKS cluster.
  7. The attacker maintains persistence by using the Valid Account (T1078) to access the cluster.

Impact

Successful exploitation leads to privilege escalation within the AKS cluster, allowing the attacker to perform actions beyond their intended authorization. This can lead to unauthorized access to sensitive data, modification or deletion of critical resources, and potential compromise of the entire Kubernetes environment. While specific victim counts aren't available, the impact is significant for organizations relying on AKS for containerized applications.

Recommendation

  • Deploy the Sigma rule Detect AKS Role Binding Creation to detect the creation of role bindings in your AKS environment by monitoring Azure Activity Logs.
  • Review and tighten Role-Based Access Control (RBAC) policies to ensure that only necessary permissions are granted (reference: description).
  • Investigate any detected role binding creations to validate their legitimacy and identify potential unauthorized privilege escalation attempts (reference: description).
  • Monitor event.outcome to ensure the operation was successful and not a failed attempt, which might indicate a misconfiguration or testing (reference: description).
]]>lowadvisorycloudazurekubernetesprivilege-escalationAzure Kubernetes Services (AKS) Kubernetes Pod Deletionhttps://feed.craftedsignal.io/briefs/2024-01-aks-pod-deletion/Tue, 02 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-aks-pod-deletion/The deletion of Azure Kubernetes Pods can indicate malicious activity aimed at disrupting the environment's normal behavior.This detection identifies the deletion of Azure Kubernetes Pods, which could indicate malicious activity. Adversaries might delete Kubernetes pods to disrupt services or evade detection. Successful pod deletion operations logged in Azure activity logs are monitored, alerting security teams to potential unauthorized actions impacting environment stability and security. The rule focuses on events logged with the operation name "MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/PODS/DELETE" and a successful outcome. Defenders should be aware of unexpected or unauthorized pod deletions, as these actions can lead to service disruptions and potential data loss. This activity affects Azure Kubernetes Services (AKS) environments.

Attack Chain

  1. An attacker gains unauthorized access to the Azure environment, potentially through compromised credentials or exploiting a vulnerability.
  2. The attacker authenticates to the Azure API and identifies the target Kubernetes cluster and namespace.
  3. The attacker uses stolen credentials to make an authorized API call.
  4. The attacker issues a DELETE request targeting specific pods within the Kubernetes cluster, using the "MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/PODS/DELETE" operation.
  5. Azure processes the deletion request, and if authorized, removes the specified pods from the cluster.
  6. The event is logged in Azure Activity Logs with an "Success" outcome.
  7. Legitimate applications or services that rely on the deleted pods experience disruption or failure.
  8. The attacker achieves their objective, which may include disrupting services, causing data loss, or hindering incident response efforts.

Impact

Successful pod deletions can lead to service disruptions, application failures, and potential data loss within the Azure Kubernetes Services (AKS) environment. The severity depends on the criticality of the affected pods and the applications they support. A successful attack could impact the availability of customer-facing services, internal business processes, or critical infrastructure components. Undetected malicious pod deletions can also complicate incident response efforts and prolong the time it takes to restore normal operations.

Recommendation

  • Deploy the Sigma rule Azure Kubernetes Pod Deletion to your SIEM and tune for your environment to detect malicious or accidental pod deletions in your Azure environment.
  • Review Azure activity logs for events matching the MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/PODS/DELETE operation name to identify potential pod deletion incidents.
  • Implement stricter access controls and role-based access management to minimize the risk of unauthorized pod deletions.
  • Integrate monitoring and alerting with a SIEM system to detect and respond to unauthorized pod deletions promptly (refer to the setup instructions in the overview).
]]>mediumadvisoryazurekubernetesimpactcloud