Synopsis
Activation Period |
14 Days |
Training Period |
30 Days |
Test Period |
N/A (single event) |
Deduplication Period |
5 Days |
Required Data |
|
Detection Modules |
|
Detector Tags |
Kubernetes - AGENT |
ATT&CK Tactic |
|
ATT&CK Technique |
|
Severity |
Informational |
Description
The Kubernetes API server was accessed from within a pod.
Attacker's Goals
Usage of the Kubernetes API server to perform operations inside the cluster.
Investigative actions
Check if there is an active attack against the Kubernetes cluster.
Variations
Unusual Kubernetes API server communication from within a pod performed by curl processUnusual Kubernetes API server communication from within a pod