Query: Sigma YAML for kubernetes / audit
Matching passage: Sigma rule: Detects potential Kubernetes enumeration or attack activity via the audit log. This includes the execution of common she. Logsource: kubernetes / audit. Rule: title: Kubernetes Potential Enumeration Activity id: 597a7e84-187d-458b-9e4f-2f5a0e676711 status: experimental description: 'Detects potential Kubernetes enumeration or attack activity via the audit log. This includes the execution of common shells, utilities, or specialized tools like ''Rakkess'' (access_matrix) and ''TruffleHog'' via Kubernetes API requests. Attackers use these methods to perform reconnaissance (enumeration), secret harvesting, or execute code (exec) within a cluster. ' references: - https://www.nccgroup.com/research/detection-engineering-for-kubernetes-clusters/ - https://github.com/trufflesecurity/trufflehog - https://github.com/corneliusweig/rakkess author: uniqu3-us3r date: 2026-04-28 tags: - attack.execution - attack.discovery - attack.t1609 - attack.t1613 logsource: product: kubernetes service: audit detection: selection_status: responseStatus.code: ALLOW selection_request_uri: requestURI|contains: - '%2fbin%2fash' - '%2fbin%2fbash' - '%2fbin%2fbusybox' - '%2fbin%2fdash' - '%2fbin%2fsh' - '%2fbin%2fzsh' - /bin/ash - /bin/bash - /bin/busybox - /bin/dash - /bin/sh - /bin/zsh - '%2fusr%2fbin%2fcurl' - '%2fusr%2fbin%2fkubectl' - '%2fusr%2fbin%2fperl' - '%2fusr%2fbin%2fpython' - '%2fusr%2fbin%2fwget' - /usr/bin/curl - /usr/bin/kubectl - /usr/bin/perl - /usr/bin/python - /usr/bin/wget selection_request_user_agent: userAgent|contains: - access_matrix - trufflehog - azurehound - micro-scanner condition: selection_status and 1 of selection_request_* falsepositives: - Authorized administrative maintenance via kubectl - Automated internal infrastructure monitoring and certificate rotation - Security-approved vulnerability or secret scanning in DevSecOps pipelines level: medium
Near-miss passage: Sigma rule: Detects potential process injection via Microsoft Remote Asssistance (Msra.exe) by looking at suspicious child processes. Logsource: windows / process_creation. Rule: title: Potential Process Injection Via Msra.EXE id: 744a188b-0415-4792-896f-11ddb0588dbc status: test description: Detects potential process injection via Microsoft Remote Asssistance (Msra.exe) by looking at suspicious child processes spawned from the aforementioned process. It has been a target used by many threat actors and used for discovery and persistence tactics references: - https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/ - https://www.fortinet.com/content/dam/fortinet/assets/analyst-reports/ar-qakbot.pdf author: Alexander McDonald date: 2022-06-24 modified: 2023-02-03 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \msra.exe ParentCommandLine|endswith: msra.exe Image|endswith: - \arp.exe - \cmd.exe - \net.exe - \netstat.exe - \nslookup.exe - \route.exe - \schtasks.exe - \whoami.exe condition: selection falsepositives: - Legitimate use of Msra.exe level: high