Query: rule covering Detects potential Kubernetes enumeration or attack activity via the audit log. This includes the execution of common she
Matching passage: Sigma rule: Detects potential Kubernetes enumeration or attack activity via the audit log. This includes the execution of common she. Logsource: kubernetes / audit. Rule: title: Kubernetes Potential Enumeration Activity id: 597a7e84-187d-458b-9e4f-2f5a0e676711 status: experimental description: 'Detects potential Kubernetes enumeration or attack activity via the audit log. This includes the execution of common shells, utilities, or specialized tools like ''Rakkess'' (access_matrix) and ''TruffleHog'' via Kubernetes API requests. Attackers use these methods to perform reconnaissance (enumeration), secret harvesting, or execute code (exec) within a cluster. ' references: - https://www.nccgroup.com/research/detection-engineering-for-kubernetes-clusters/ - https://github.com/trufflesecurity/trufflehog - https://github.com/corneliusweig/rakkess author: uniqu3-us3r date: 2026-04-28 tags: - attack.execution - attack.discovery - attack.t1609 - attack.t1613 logsource: product: kubernetes service: audit detection: selection_status: responseStatus.code: ALLOW selection_request_uri: requestURI|contains: - '%2fbin%2fash' - '%2fbin%2fbash' - '%2fbin%2fbusybox' - '%2fbin%2fdash' - '%2fbin%2fsh' - '%2fbin%2fzsh' - /bin/ash - /bin/bash - /bin/busybox - /bin/dash - /bin/sh - /bin/zsh - '%2fusr%2fbin%2fcurl' - '%2fusr%2fbin%2fkubectl' - '%2fusr%2fbin%2fperl' - '%2fusr%2fbin%2fpython' - '%2fusr%2fbin%2fwget' - /usr/bin/curl - /usr/bin/kubectl - /usr/bin/perl - /usr/bin/python - /usr/bin/wget selection_request_user_agent: userAgent|contains: - access_matrix - trufflehog - azurehound - micro-scanner condition: selection_status and 1 of selection_request_* falsepositives: - Authorized administrative maintenance via kubectl - Automated internal infrastructure monitoring and certificate rotation - Security-approved vulnerability or secret scanning in DevSecOps pipelines level: medium
Near-miss passage: Sigma rule: Detects uncommon service installation commands by looking at suspicious or uncommon image path values containing referen. Logsource: windows / system. Rule: title: Uncommon Service Installation Image Path id: 26481afe-db26-4228-b264-25a29fe6efc7 related: - id: ca83e9f3-657a-45d0-88d6-c1ac280caf53 type: obsolete - id: 1d61f71d-59d2-479e-9562-4ff5f4ead16b type: derived status: test description: 'Detects uncommon service installation commands by looking at suspicious or uncommon image path values containing references to encoded powershell commands, temporary paths, etc. ' references: - Internal Research author: Florian Roth (Nextron Systems) date: 2022-03-18 modified: 2024-02-09 tags: - attack.persistence - attack.privilege-escalation - car.2013-09-005 - attack.t1543.003 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 suspicious_paths: ImagePath|contains: - \\\\.\\pipe - \Users\Public\ - \Windows\Temp\ suspicious_encoded_flag: ImagePath|contains: ' -e' suspicious_encoded_keywords: ImagePath|contains: - ' aQBlAHgA' - ' aWV4I' - ' IAB' - ' JAB' - ' PAA' - ' SQBFAFgA' - ' SUVYI' filter_optional_thor_remote: ImagePath|startswith: C:\WINDOWS\TEMP\thor10-remote\thor64.exe filter_main_defender_def_updates: ImagePath|startswith: C:\ProgramData\Microsoft\Windows Defender\Definition Updates\ condition: selection and ( suspicious_paths or all of suspicious_encoded_* ) and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium