Cisco Isovalent - new detections batch 1 #3706
Conversation
| @@ -0,0 +1,3 @@ | |||
| definition: pod_image_name IN ("docker.io/library/ubuntu:22.04") | |||
There was a problem hiding this comment.
Maybe add cilium versions since its seems to be used with isovalent too
There was a problem hiding this comment.
Good point, adding these images since they are configured while setting up isovalent:
("docker.io/library/ubuntu:22.04","docker.io/grafana/grafana:12.0.1", "quay.io/isovalent-dev/tetragon-ci*",""quay.io/isovalent/tetragon-ci*","quay.io/isovalent/hubble-export-fluentd*")
| status: production | ||
| description: The following analytic detects execution of nsenter from within a container, including explicit attempts to join the host’s mount namespace via --mount=/host/proc/1/ns/mnt. Adversaries commonly use nsenter when a pod is misconfigured with excessive privileges (e.g., privileged, hostPID, or broad hostPath mounts) to interact with the underlying node filesystem and processes. This behavior may indicate a container escape attempt to gain persistence or control over the Kubernetes node. Extra scrutiny is warranted for workloads running with privileged security contexts or access to host namespaces and for pods that suddenly begin invoking nsenter outside of normal maintenance activity. | ||
| search: | | ||
| `cisco_isovalent_process_exec` process_name="nsenter" OR process="--mount=/host/proc/1/ns/mnt" |
There was a problem hiding this comment.
the proc/1 in this instance refers to your shell i presume. But I don't think this would always be the case right?
If so maybe we can drop it and focus on the binary name?
Just thinking out loud
| The analytic compares the process start time to the container start time and flags processes | ||
| launched more than 5 minutes (300 seconds) after initialization. |
There was a problem hiding this comment.
Random question for you, would this not trigger on cron jobs that occurs in the future ?
Co-authored-by: Nasreddine Bencherchali <[email protected]>
Co-authored-by: Nasreddine Bencherchali <[email protected]>
Added 8 new detections , added isovalent datasets for existing searches
1 new story
1 data source