Merge pull request #867 from splunk/Kubernetes_Privileged_Pod

Kubernetes Privileged Pod
splunk · Dec 14, 2023 · de1ae1c · de1ae1c
2 parents 4a15301 + 877714d
commit de1ae1c
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 0 deletions.
diff --git a/datasets/attack_techniques/T1204/kubernetes_privileged_pod/kubernetes_privileged_pod.json b/datasets/attack_techniques/T1204/kubernetes_privileged_pod/kubernetes_privileged_pod.json
diff --git a/datasets/attack_techniques/T1204/kubernetes_privileged_pod/kubernetes_privileged_pod.yml b/datasets/attack_techniques/T1204/kubernetes_privileged_pod/kubernetes_privileged_pod.yml
@@ -0,0 +1,11 @@
+author: Patrick Bareiss
+id: 462dfa0b-7aa4-4498-927b-8d9743141e3a
+date: '2023-12-14'
+description: Kubernetes audit logs which contains a creation of a privilged pod.
+environment: attack_range
+dataset:
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204/kubernetes_privileged_pod/kubernetes_privileged_pod.json
+sourcetypes:
+- aws:cloudwatchlogs
+references:
+- https://attack.mitre.org/techniques/T1204