{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/isovalent-runtime-security/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Isovalent Runtime Security"],"_cs_severities":["medium"],"_cs_tags":["kubernetes","cloud-security","process-monitoring"],"_cs_type":"advisory","_cs_vendors":["Cisco"],"content_html":"\u003cp\u003eMonitoring of Kubernetes environments reveals that curl commands are frequently executed with insecure flags, such as -k or --insecure, to circumvent SSL/TLS verification during file transfers. This activity is often associated with the ingress of unauthorized tools or payloads into containerized environments. Within the Cisco Isovalent platform, defenders can monitor process execution logs to identify these commands. This behavior is notable because bypassing certificate validation exposes the infrastructure to man-in-the-middle attacks, potentially leading to sensitive data interception, service disruption, or unauthorized access to the cluster. SOC teams should investigate such executions to determine if they originate from legitimate administrative scripts or indicate malicious activity.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains initial access to a Kubernetes pod, possibly via compromised container applications.\u003c/li\u003e\n\u003cli\u003eAttacker attempts to download external malicious tools or configuration files using curl.\u003c/li\u003e\n\u003cli\u003eThe target server uses self-signed or invalid certificates, preventing standard curl requests.\u003c/li\u003e\n\u003cli\u003eAttacker executes curl with the -k or --insecure flag to force the connection despite certificate validation errors.\u003c/li\u003e\n\u003cli\u003eThe insecure connection is established, potentially allowing an interceptor to perform a man-in-the-middle attack.\u003c/li\u003e\n\u003cli\u003eThe attacker successfully pulls the secondary stage payload or configuration into the container.\u003c/li\u003e\n\u003cli\u003eThe attacker executes the downloaded payload to conduct further malicious actions, such as lateral movement or data exfiltration.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows attackers to bypass infrastructure security controls, leading to the ingress of unauthorized payloads, potential interception of sensitive communications, and unauthorized access to the Kubernetes control plane or pod secrets. This impacts security posture by weakening the transport layer security required for cloud-native workloads.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy detection logic to monitor process execution logs within the Cisco Isovalent environment for curl commands containing insecure flags.\u003c/li\u003e\n\u003cli\u003eAudit administrative scripts and container entrypoints that utilize curl to ensure certificate verification is enforced where feasible.\u003c/li\u003e\n\u003cli\u003eUse the provided Sigma rule to detect these command-line arguments in process monitoring telemetry.\u003c/li\u003e\n\u003cli\u003eInvestigate triggered alerts by cross-referencing with pod activity and established cron jobs to reduce noise from legitimate administrative tasks.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T17:36:38Z","date_published":"2026-10-12T17:36:38Z","id":"https://feed.craftedsignal.io/briefs/2026-10-curl-insecure-flags/","summary":"Threat actors may leverage curl with insecure flags within Kubernetes environments to bypass TLS certificate verification, facilitating man-in-the-middle attacks and unauthorized tool ingress.","title":"Detection of Insecure Curl Execution in Kubernetes Clusters","url":"https://feed.craftedsignal.io/briefs/2026-10-curl-insecure-flags/"}],"language":"en","title":"CraftedSignal Threat Feed - Isovalent Runtime Security","version":"https://jsonfeed.org/version/1.1"}