Query: Sigma rule for Detects potential Kubernetes enumeration or attack activity via the audit log. This includes the execution of common she
Matching passage: Sigma rule: Detects potential Kubernetes enumeration or attack activity via the audit log. This includes the execution of common she. Logsource: kubernetes / audit. Rule: title: Kubernetes Potential Enumeration Activity id: 597a7e84-187d-458b-9e4f-2f5a0e676711 status: experimental description: 'Detects potential Kubernetes enumeration or attack activity via the audit log. This includes the execution of common shells, utilities, or specialized tools like ''Rakkess'' (access_matrix) and ''TruffleHog'' via Kubernetes API requests. Attackers use these methods to perform reconnaissance (enumeration), secret harvesting, or execute code (exec) within a cluster. ' references: - https://www.nccgroup.com/research/detection-engineering-for-kubernetes-clusters/ - https://github.com/trufflesecurity/trufflehog - https://github.com/corneliusweig/rakkess author: uniqu3-us3r date: 2026-04-28 tags: - attack.execution - attack.discovery - attack.t1609 - attack.t1613 logsource: product: kubernetes service: audit detection: selection_status: responseStatus.code: ALLOW selection_request_uri: requestURI|contains: - '%2fbin%2fash' - '%2fbin%2fbash' - '%2fbin%2fbusybox' - '%2fbin%2fdash' - '%2fbin%2fsh' - '%2fbin%2fzsh' - /bin/ash - /bin/bash - /bin/busybox - /bin/dash - /bin/sh - /bin/zsh - '%2fusr%2fbin%2fcurl' - '%2fusr%2fbin%2fkubectl' - '%2fusr%2fbin%2fperl' - '%2fusr%2fbin%2fpython' - '%2fusr%2fbin%2fwget' - /usr/bin/curl - /usr/bin/kubectl - /usr/bin/perl - /usr/bin/python - /usr/bin/wget selection_request_user_agent: userAgent|contains: - access_matrix - trufflehog - azurehound - micro-scanner condition: selection_status and 1 of selection_request_* falsepositives: - Authorized administrative maintenance via kubectl - Automated internal infrastructure monitoring and certificate rotation - Security-approved vulnerability or secret scanning in DevSecOps pipelines level: medium
Near-miss passage: Sigma rule: Detects the use of SysmonEnte, a tool to attack the integrity of Sysmon. Logsource: windows / process_access. Rule: title: HackTool - SysmonEnte Execution id: d29ada0f-af45-4f27-8f32-f7b77c3dbc4e status: test description: Detects the use of SysmonEnte, a tool to attack the integrity of Sysmon references: - https://codewhitesec.blogspot.com/2022/09/attacks-on-sysmon-revisited-sysmonente.html - https://github.com/codewhitesec/SysmonEnte/ - https://github.com/codewhitesec/SysmonEnte/blob/fe267690fcc799fbda15398243615a30451d9099/screens/1.png author: Florian Roth (Nextron Systems) date: 2022-09-07 modified: 2026-06-29 tags: - attack.defense-impairment - attack.t1685.001 logsource: category: process_access product: windows detection: selection_sysmon: TargetImage|contains: - :\Windows\Sysmon.exe - :\Windows\Sysmon64.exe - :\Windows\Sysmon64a.exe GrantedAccess: '0x1400' selection_calltrace: CallTrace: Ente filter_main_generic: SourceImage|contains: - :\Program Files (x86)\ - :\Program Files\ - :\Windows\System32\ - :\Windows\SysWOW64\ filter_main_msdefender: SourceImage|contains: :\ProgramData\Microsoft\Windows Defender\Platform\ SourceImage|endswith: \MsMpEng.exe condition: ( selection_sysmon and not 1 of filter_main_* ) or selection_calltrace falsepositives: - Unknown level: high