Merge pull request #857 from splunk/kubernetes_scanning

kubernetes scanning
splunk · Dec 7, 2023 · f4be4ca · f4be4ca
2 parents fcacaae + e344cfa
commit f4be4ca
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 0 deletions.
diff --git a/datasets/attack_techniques/T1046/kubernetes_scanning/kubernetes_scanning.json b/datasets/attack_techniques/T1046/kubernetes_scanning/kubernetes_scanning.json
diff --git a/datasets/attack_techniques/T1046/kubernetes_scanning/kubernetes_scanning.yml b/datasets/attack_techniques/T1046/kubernetes_scanning/kubernetes_scanning.yml
@@ -0,0 +1,11 @@
+author: Patrick Bareiss
+id: d8aaa455-a7ba-4bd8-a588-e09ef1dce552
+date: '2023-12-07'
+description: Kubernetes scanning activity in Kubernetes audit logs.
+environment: attack_range
+dataset:
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1046/kubernetes_scanning/kubernetes_scanning.json
+sourcetypes:
+- aws:cloudwatchlogs
+references:
+- https://attack.mitre.org/techniques/T1046