Merge pull request #865 from splunk/Kubernetes-DaemonSet

Kubernetes DaemonSet
splunk · Dec 14, 2023 · 4a15301 · 4a15301
2 parents 7282cde + b245f93
commit 4a15301
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 0 deletions.
diff --git a/...chniques/T1204/kubernetes_audit_daemonset_created/kubernetes_audit_daemonset_created.json b/...chniques/T1204/kubernetes_audit_daemonset_created/kubernetes_audit_daemonset_created.json
diff --git a/...echniques/T1204/kubernetes_audit_daemonset_created/kubernetes_audit_daemonset_created.yml b/...echniques/T1204/kubernetes_audit_daemonset_created/kubernetes_audit_daemonset_created.yml
@@ -0,0 +1,11 @@
+author: Patrick Bareiss
+id: da189cbc-c959-4681-a173-e409949470d4
+date: '2023-12-14'
+description: Kubernetes audit logs which contains a creation of a DaemonSet.
+environment: attack_range
+dataset:
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204/kubernetes_audit_daemonset_created/kubernetes_audit_daemonset_created.json
+sourcetypes:
+- aws:cloudwatchlogs
+references:
+- https://attack.mitre.org/techniques/T1204