Audit-Logs - CraftedSignal Threat Feed

Kubernetes Unusual Decision by User Agent

hello@craftedsignal.io — Wed, 31 Jan 2024 12:00:00 +0000

This detection rule identifies unusual request responses within Kubernetes environments by analyzing audit logs for anomalies in user agents and response annotations. The rule leverages the "new_terms" rule type, focusing on deviations from expected API request patterns typically made by system components or trusted users. By monitoring discrepancies in the user_agent.original, kubernetes.audit.user.username, and kubernetes.audit.annotations.authorization_k8s_io/decision fields, the rule aims to uncover potential unauthorized access attempts, misconfigured permissions, or malicious activities exploiting atypical user agent strings. This approach enhances the security posture of Kubernetes clusters by detecting subtle indicators of compromise that might otherwise go unnoticed. The rule is intended to be deployed in production environments where consistent user agent behavior is expected from trusted sources.

Attack Chain

Initial Access: An attacker gains initial access to the Kubernetes cluster through compromised credentials or a vulnerable application.
Privilege Escalation: The attacker attempts to escalate privileges within the cluster, potentially using a service account with excessive permissions.
Discovery: The attacker performs reconnaissance activities to map out the cluster's resources, including pods, services, and secrets. They use kubectl or similar tools to query the API server.
Lateral Movement: Using the compromised credentials, the attacker moves laterally within the cluster, accessing different namespaces or nodes.
Execution: The attacker executes malicious code within a pod or container, potentially deploying a reverse shell or a cryptominer. This is achieved by sending API requests to create or modify resources.
Persistence: The attacker establishes persistence by creating a new service account with elevated privileges or by modifying existing deployments to include backdoors.
Exfiltration (Potential): The attacker attempts to exfiltrate sensitive data from the cluster, such as secrets or configuration files.
Impact: The attacker achieves their objectives, which could include data theft, denial of service, or complete control of the Kubernetes cluster.

Impact

A successful attack could lead to unauthorized access to sensitive data, disruption of services, or complete compromise of the Kubernetes cluster. While the rule itself has a low severity, the underlying activities it detects can have severe consequences. The number of potential victims depends on the scope and criticality of the affected Kubernetes deployments. If exploited, attackers can gain control of containerized applications and infrastructure, leading to data breaches, financial losses, and reputational damage.

Recommendation

Deploy the provided Sigma rule to your SIEM to detect unusual Kubernetes API requests based on user agent (see the rule section).
Regularly review Kubernetes audit logs for unusual user_agent.original values, and correlate them with other security events.
Implement strict role-based access control (RBAC) policies to minimize the attack surface.
Configure monitoring and alerting for suspicious activity within the Kubernetes cluster.
Tune the Sigma rule exceptions to account for legitimate but infrequent user agents (see the rule's false positive analysis section).

GitHub Enterprise Audit Log Streaming Disabled

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This threat brief focuses on the disabling of audit log event streaming within GitHub Enterprise environments. The disabling of audit logs is a common technique used by attackers to evade detection by security monitoring platforms. While the exact initial access vector is unknown, once an attacker gains sufficient privileges within the GitHub Enterprise environment, they may attempt to disable audit logging to mask their subsequent actions. This activity is significant for defenders because it represents a deliberate attempt to blind security monitoring and incident response teams, potentially allowing attackers to perform malicious activities without detection. The impact could be severe as organizations lose visibility into user actions, configuration changes, and security events within their GitHub Enterprise environment.

Attack Chain

Initial Access: An attacker gains unauthorized access to a GitHub Enterprise account with administrative privileges.
Privilege Escalation (If Necessary): If the initial access does not grant sufficient privileges, the attacker attempts to escalate their privileges within the GitHub Enterprise environment.
Identify Audit Log Configuration: The attacker identifies the audit log event streaming configuration settings within GitHub Enterprise.
Disable Audit Log Streaming: The attacker disables the audit log event streaming functionality, preventing audit events from being sent to security monitoring platforms. This is achieved by using the audit_log_streaming.destroy action.
Carry out Malicious Actions: With audit logging disabled, the attacker performs unauthorized activities within the GitHub Enterprise environment, such as modifying code, creating new user accounts, or exfiltrating sensitive data.
Maintain Persistence: The attacker establishes persistence mechanisms to maintain access to the compromised GitHub Enterprise environment.
Cover Tracks: The attacker attempts to further cover their tracks by deleting logs or modifying system configurations.

Impact

Disabling audit log streaming in GitHub Enterprise can have significant consequences. Organizations lose visibility into critical security events, configuration changes, and user actions within their GitHub Enterprise environment. This can enable attackers to perform malicious activities undetected, leading to data breaches, intellectual property theft, or disruption of services. The inability to monitor audit logs hinders incident response efforts and prolongs the time it takes to detect and remediate security incidents.

Recommendation

Deploy the Sigma rule GitHub Audit Log Streaming Disabled to your SIEM to detect when a user disables audit log event streaming in GitHub Enterprise.
Enable and actively monitor GitHub Enterprise audit logs using Audit log streaming as described in the documentation (https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk).
Investigate any instances of audit_log_streaming.destroy events identified in the logs to determine if they are authorized or malicious activity.
Review user access controls and permissions within GitHub Enterprise to prevent unauthorized users from disabling audit log streaming.