Merge pull request #855 from splunk/kube_audit_get_secret

Dataset k8s
splunk · Dec 6, 2023 · 8b88158 · 8b88158
2 parents 5ef0241 + 84e838b
commit 8b88158
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 0 deletions.
diff --git a/datasets/attack_techniques/T1552.007/kube_audit_get_secret/kube_audit_get_secret.json b/datasets/attack_techniques/T1552.007/kube_audit_get_secret/kube_audit_get_secret.json
diff --git a/datasets/attack_techniques/T1552.007/kube_audit_get_secret/kube_audit_get_secret.yml b/datasets/attack_techniques/T1552.007/kube_audit_get_secret/kube_audit_get_secret.yml
@@ -0,0 +1,11 @@
+author: Patrick Bareiss
+id: eeb520c4-bdea-4b79-a13e-6d7036e6ddc2
+date: '2023-12-06'
+description: Kubernetes audit log to retrieve a secret from k8s.
+environment: attack_range
+dataset:
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.007/kube_audit_get_secret/kube_audit_get_secret.json
+sourcetypes:
+- aws:cloudwatchlogs
+references:
+- https://attack.mitre.org/techniques/T1552/007/