Cisco Isovalent - new detections batch 1

data_sources/cisco_isovalent_process_exec.yml

@@ -0,0 +1,139 @@
+name: Cisco Isovalent Process Exec
+id: 87654321-dcba-4321-00fe-0987654321ba
+version: 1
+date: '2025-08-12'
+author: Bhavin Patel, Splunk
+description: Logs process execution events within Cisco Isovalent environments, providing visibility into process exec ancestry and Kubernetes workload identity.
+source: not_applicable
+sourcetype: cisco:isovalent:processExec
+supported_TA:
+- name: Cisco Security Cloud
+  url: https://splunkbase.splunk.com/app/7404
+  version: 3.4.1
+fields:
+- _time
+- cluster_name
+- container_id
+- eventtype
+- host
+- index
+- linecount
+- node_labels.alpha.eksctl.io/cluster-name
+- node_labels.alpha.eksctl.io/nodegroup-name
+- node_labels.beta.kubernetes.io/arch
+- node_labels.beta.kubernetes.io/instance-type
+- node_labels.beta.kubernetes.io/os
+- node_labels.eks.amazonaws.com/capacityType
+- node_labels.eks.amazonaws.com/nodegroup
+- node_labels.eks.amazonaws.com/nodegroup-image
+- node_labels.eks.amazonaws.com/sourceLaunchTemplateId
+- node_labels.eks.amazonaws.com/sourceLaunchTemplateVersion
+- node_labels.failure-domain.beta.kubernetes.io/region
+- node_labels.failure-domain.beta.kubernetes.io/zone
+- node_labels.k8s.io/cloud-provider-aws
+- node_labels.kubernetes.io/arch
+- node_labels.kubernetes.io/hostname
+- node_labels.kubernetes.io/os
+- node_labels.node.kubernetes.io/instance-type
+- node_labels.topology.k8s.aws/zone-id
+- node_labels.topology.kubernetes.io/region
+- node_labels.topology.kubernetes.io/zone
+- node_name
+- parent_process
+- parent_process_exec
+- parent_process_id
+- parent_process_name
+- parent_process_path
+- pod_image_name
+- pod_name
+- pod_namespace
+- process
+- process_current_directory
+- process_exec
+- process_exec.ancestors{}.arguments
+- process_exec.ancestors{}.auid
+- process_exec.ancestors{}.binary
+- process_exec.ancestors{}.cwd
+- process_exec.ancestors{}.exec_id
+- process_exec.ancestors{}.flags
+- process_exec.ancestors{}.in_init_tree
+- process_exec.ancestors{}.parent_exec_id
+- process_exec.ancestors{}.pid
+- process_exec.ancestors{}.refcnt
+- process_exec.ancestors{}.start_time
+- process_exec.ancestors{}.tid
+- process_exec.ancestors{}.uid
+- process_exec.parent.arguments
+- process_exec.parent.auid
+- process_exec.parent.binary
+- process_exec.parent.cwd
+- process_exec.parent.docker
+- process_exec.parent.exec_id
+- process_exec.parent.flags
+- process_exec.parent.in_init_tree
+- process_exec.parent.parent_exec_id
+- process_exec.parent.pid
+- process_exec.parent.pod.container.id
+- process_exec.parent.pod.container.image.id
+- process_exec.parent.pod.container.image.name
+- process_exec.parent.pod.container.name
+- process_exec.parent.pod.container.pid
+- process_exec.parent.pod.container.security_context.privileged
+- process_exec.parent.pod.container.start_time
+- process_exec.parent.pod.name
+- process_exec.parent.pod.namespace
+- process_exec.parent.pod.pod_labels.controller-revision-hash
+- process_exec.parent.pod.pod_labels.k8s-app
+- process_exec.parent.pod.pod_labels.pod-template-generation
+- process_exec.parent.pod.workload
+- process_exec.parent.pod.workload_kind
+- process_exec.parent.start_time
+- process_exec.parent.tid
+- process_exec.parent.uid
+- process_exec.process.arguments
+- process_exec.process.auid
+- process_exec.process.binary
+- process_exec.process.cwd
+- process_exec.process.docker
+- process_exec.process.exec_id
+- process_exec.process.flags
+- process_exec.process.in_init_tree
+- process_exec.process.parent_exec_id
+- process_exec.process.pid
+- process_exec.process.pod.container.id
+- process_exec.process.pod.container.image.id
+- process_exec.process.pod.container.image.name
+- process_exec.process.pod.container.maybe_exec_probe
+- process_exec.process.pod.container.name
+- process_exec.process.pod.container.pid
+- process_exec.process.pod.container.security_context.privileged
+- process_exec.process.pod.container.start_time
+- process_exec.process.pod.name
+- process_exec.process.pod.namespace
+- process_exec.process.pod.pod_labels.app.kubernetes.io/instance
+- process_exec.process.pod.pod_labels.app.kubernetes.io/name
+- process_exec.process.pod.pod_labels.controller-revision-hash
+- process_exec.process.pod.pod_labels.k8s-app
+- process_exec.process.pod.pod_labels.pod-template-generation
+- process_exec.process.pod.workload
+- process_exec.process.pod.workload_kind
+- process_exec.process.start_time
+- process_exec.process.tid
+- process_exec.process.uid
+- process_id
+- process_name
+- punct
+- source
+- sourcetype
+- splunk_server
+- splunk_server_group
+- tag
+- tag::eventtype
+- time
+- user_id
+- vendor_product
+output_fields:
+- process_name
+- process
+example_log: |
+ {"process_exec":{"process":{"exec_id":"aXAtMTAtMC0xMC0yNTMudXMtd2VzdC0yLmNvbXB1dGUuaW50ZXJuYWw6MTQ2Mjg5OTk5MjQ2MDAwNDozNTAyOTE0","pid":3502914,"uid":0,"cwd":"/app","binary":"/app/grpc-health-probe","arguments":"-addr=:50051 -connect-timeout=5s -rpc-timeout=5s","flags":"execve clone","start_time":"2025-08-14T20:42:47.459946745Z","auid":4294967295,"pod":{"namespace":"kube-system","name":"aws-node-9twpn","container":{"id":"containerd://dc5b541d139c38ec01e485712f0eec3d11c0273ca03fccedc56881200c127873","name":"aws-node","image":{"id":"sha256:0b48ad70935c9dea3627854c46a5d12028b941334ad82bf7be6a6fcddd4a2674","name":"066635153087.dkr.ecr.il-central-1.amazonaws.com/amazon-k8s-cni:v1.19.2"},"start_time":"2025-07-28T22:21:44Z","pid":3635324,"maybe_exec_probe":true,"security_context":{}},"pod_labels":{"app.kubernetes.io/instance":"aws-vpc-cni","app.kubernetes.io/name":"aws-node","controller-revision-hash":"dfddff8c5","k8s-app":"aws-node","pod-template-generation":"1"},"workload":"aws-node","workload_kind":"DaemonSet"},"docker":"dc5b541d139c38ec01e485712f0eec3","parent_exec_id":"aXAtMTAtMC0xMC0yNTMudXMtd2VzdC0yLmNvbXB1dGUuaW50ZXJuYWw6MTQ2Mjg5OTk3MjA5OTEyODozNTAyOTAw","tid":3502914,"in_init_tree":false},"parent":{"exec_id":"aXAtMTAtMC0xMC0yNTMudXMtd2VzdC0yLmNvbXB1dGUuaW50ZXJuYWw6MTQ2Mjg5OTk3MjA5OTEyODozNTAyOTAw","pid":3502900,"uid":0,"cwd":"/run/containerd/io.containerd.runtime.v2.task/k8s.io/ed66ffdf41f1a8120a25b8aee2609990a556109a17fb159597cb100f574b07fe","binary":"/usr/sbin/runc","arguments":"--root /run/containerd/runc/k8s.io --log /run/containerd/io.containerd.runtime.v2.task/k8s.io/dc5b541d139c38ec01e485712f0eec3d11c0273ca03fccedc56881200c127873/log.json --log-format json --systemd-cgroup exec --process /tmp/runc-process2848112653 --detach --pid-file /run/containerd/io.containerd.runtime.v2.task/k8s.io/dc5b541d139c38ec01e485712f0eec3d11c0273ca03fccedc56881200c127873/939f032732ee71076b86175deba715fc56e5cacb6047fb3602069bdbbfd21e45.pid dc5b541d139c38ec01e485712f0eec3d11c0273ca03fccedc56881200c127873","flags":"execve clone","start_time":"2025-08-14T20:42:47.439585277Z","auid":4294967295,"parent_exec_id":"aXAtMTAtMC0xMC0yNTMudXMtd2VzdC0yLmNvbXB1dGUuaW50ZXJuYWw6MjczNDAwMDAwMDA6MzA1OQ==","tid":3502900,"in_init_tree":false},"ancestors":[{"exec_id":"aXAtMTAtMC0xMC0yNTMudXMtd2VzdC0yLmNvbXB1dGUuaW50ZXJuYWw6MjczNDAwMDAwMDA6MzA1OQ==","pid":3059,"uid":0,"cwd":"/run/containerd/io.containerd.runtime.v2.task/k8s.io/ed66ffdf41f1a8120a25b8aee2609990a556109a17fb159597cb100f574b07fe","binary":"/usr/bin/containerd-shim-runc-v2","arguments":"-namespace k8s.io -id ed66ffdf41f1a8120a25b8aee2609990a556109a17fb159597cb100f574b07fe -address /run/containerd/containerd.sock","flags":"procFS auid","start_time":"2025-07-28T22:21:34.807485194Z","auid":4294967295,"parent_exec_id":"aXAtMTAtMC0xMC0yNTMudXMtd2VzdC0yLmNvbXB1dGUuaW50ZXJuYWw6NjAwMDAwMDA6MQ==","tid":3059,"in_init_tree":false},{"exec_id":"aXAtMTAtMC0xMC0yNTMudXMtd2VzdC0yLmNvbXB1dGUuaW50ZXJuYWw6NjAwMDAwMDA6MQ==","pid":1,"uid":0,"cwd":"/","binary":"/usr/lib/systemd/systemd","arguments":"--switched-root --system --deserialize 21","flags":"procFS auid rootcwd","start_time":"2025-07-28T22:21:07.527485203Z","auid":4294967295,"parent_exec_id":"aXAtMTAtMC0xMC0yNTMudXMtd2VzdC0yLmNvbXB1dGUuaW50ZXJuYWw6MTow","tid":1,"in_init_tree":false}]},"node_name":"ip-10-0-10-253.us-west-2.compute.internal","time":"2025-08-14T20:42:47.459945318Z","cluster_name":"isovalent-2","node_labels":{"alpha.eksctl.io/cluster-name":"isovalent-2","alpha.eksctl.io/instance-id":"i-0839d680c54ccef60","alpha.eksctl.io/nodegroup-name":"ng-default","beta.kubernetes.io/arch":"amd64","beta.kubernetes.io/instance-type":"t3.medium","beta.kubernetes.io/os":"linux","failure-domain.beta.kubernetes.io/region":"us-west-2","failure-domain.beta.kubernetes.io/zone":"us-west-2c","k8s.io/cloud-provider-aws":"480fc25a68b07748a13498c4eb5a2a07","kubernetes.io/arch":"amd64","kubernetes.io/hostname":"ip-10-0-10-253.us-west-2.compute.internal","kubernetes.io/os":"linux","node-lifecycle":"on-demand","node.kubernetes.io/instance-type":"t3.medium","topology.k8s.aws/zone-id":"usw2-az3","topology.kubernetes.io/region":"us-west-2","topology.kubernetes.io/zone":"us-west-2c"}}

data_sources/cisco_isovalent_process_kprobe.yml

@@ -0,0 +1,121 @@
+name: Cisco Isovalent Process Kprobe
+id: b2620ef2-fac6-467f-bdc8-253d65db1cb9
+version: 1
+date: '2025-10-06'
+author: Bhavin Patel, Splunk
+description: Captures kernel probe (kprobe) telemetry from Cisco Isovalent Runtime Security, including function name, arguments, and process context, enabling visibility into low-level kernel interactions that may indicate container escape attempts or system tampering.
+source: not_applicable
+sourcetype: cisco:isovalent
+supported_TA:
+- name: Cisco Security Cloud
+  url: https://splunkbase.splunk.com/app/7404
+  version: 3.4.2
+fields:
+- _time
+- app
+- cluster_name
+- description
+- duration
+- eventtype
+- host
+- id
+- index
+- linecount
+- node_labels.alpha.eksctl.io/cluster-name
+- node_labels.alpha.eksctl.io/nodegroup-name
+- node_labels.beta.kubernetes.io/arch
+- node_labels.beta.kubernetes.io/instance-type
+- node_labels.beta.kubernetes.io/os
+- node_labels.eks.amazonaws.com/capacityType
+- node_labels.eks.amazonaws.com/nodegroup
+- node_labels.eks.amazonaws.com/nodegroup-image
+- node_labels.eks.amazonaws.com/sourceLaunchTemplateId
+- node_labels.eks.amazonaws.com/sourceLaunchTemplateVersion
+- node_labels.failure-domain.beta.kubernetes.io/region
+- node_labels.failure-domain.beta.kubernetes.io/zone
+- node_labels.k8s.io/cloud-provider-aws
+- node_labels.kubernetes.io/arch
+- node_labels.kubernetes.io/hostname
+- node_labels.kubernetes.io/os
+- node_labels.node.kubernetes.io/instance-type
+- node_labels.topology.k8s.aws/zone-id
+- node_labels.topology.kubernetes.io/region
+- node_labels.topology.kubernetes.io/zone
+- node_name
+- process_kprobe.action
+- process_kprobe.args{}.bytes_arg
+- process_kprobe.args{}.int_arg
+- process_kprobe.args{}.label
+- process_kprobe.args{}.size_arg
+- process_kprobe.args{}.string_arg
+- process_kprobe.function_name
+- process_kprobe.parent.arguments
+- process_kprobe.parent.auid
+- process_kprobe.parent.binary
+- process_kprobe.parent.cwd
+- process_kprobe.parent.docker
+- process_kprobe.parent.exec_id
+- process_kprobe.parent.flags
+- process_kprobe.parent.in_init_tree
+- process_kprobe.parent.parent_exec_id
+- process_kprobe.parent.pid
+- process_kprobe.parent.pod.container.id
+- process_kprobe.parent.pod.container.image.id
+- process_kprobe.parent.pod.container.image.name
+- process_kprobe.parent.pod.container.name
+- process_kprobe.parent.pod.container.pid
+- process_kprobe.parent.pod.container.start_time
+- process_kprobe.parent.pod.name
+- process_kprobe.parent.pod.namespace
+- process_kprobe.parent.pod.pod_labels.run
+- process_kprobe.parent.pod.workload
+- process_kprobe.parent.pod.workload_kind
+- process_kprobe.parent.start_time
+- process_kprobe.parent.tid
+- process_kprobe.parent.uid
+- process_kprobe.policy_name
+- process_kprobe.process.arguments
+- process_kprobe.process.auid
+- process_kprobe.process.binary
+- process_kprobe.process.cwd
+- process_kprobe.process.docker
+- process_kprobe.process.exec_id
+- process_kprobe.process.flags
+- process_kprobe.process.in_init_tree
+- process_kprobe.process.parent_exec_id
+- process_kprobe.process.pid
+- process_kprobe.process.pod.container.id
+- process_kprobe.process.pod.container.image.id
+- process_kprobe.process.pod.container.image.name
+- process_kprobe.process.pod.container.name
+- process_kprobe.process.pod.container.pid
+- process_kprobe.process.pod.container.start_time
+- process_kprobe.process.pod.name
+- process_kprobe.process.pod.namespace
+- process_kprobe.process.pod.pod_labels.run
+- process_kprobe.process.pod.workload
+- process_kprobe.process.pod.workload_kind
+- process_kprobe.process.refcnt
+- process_kprobe.process.start_time
+- process_kprobe.process.tid
+- process_kprobe.process.uid
+- process_kprobe.return_action
+- punct
+- severity
+- source
+- sourcetype
+- splunk_server
+- splunk_server_group
+- src
+- src_type
+- tag
+- tag::app
+- tag::eventtype
+- time
+- vendor_region
+output_fields:
+- pod_name
+example_log: |
+ {"process_kprobe":{"process":{"exec_id":"aXAtMTkyLTE2OC04OS02NC51cy13ZXN0LTIuY29tcHV0ZS5pbnRlcm5hbDoyNjA5NjE5NjIwOTk3MjEyOjEwNTYwNDc=","pid":1056047,"uid":0,"cwd":"/","binary":"/usr/sbin/logrotate","arguments":"/etc/logrotate.conf","flags":"execve","start_time":"2025-10-06T00:00:46.054215601Z","auid":4294967295,"parent_exec_id":"aXAtMTkyLTE2OC04OS02NC51cy13ZXN0LTIuY29tcHV0ZS5pbnRlcm5hbDoyNjA5NjE5NTA2MTI3NjQ4OjEwNTYwNDI=","refcnt":1,"tid":1056047,"in_init_tree":false},"parent":{"exec_id":"aXAtMTkyLTE2OC04OS02NC51cy13ZXN0LTIuY29tcHV0ZS5pbnRlcm5hbDoyNjA5NjE5NTA2MTI3NjQ4OjEwNTYwNDI=","pid":1056042,"uid":0,"cwd":"/","binary":"/usr/sbin/logrotate","arguments":"/etc/logrotate.conf","flags":"execve rootcwd clone","start_time":"2025-10-06T00:00:45.939345635Z","auid":4294967295,"parent_exec_id":"aXAtMTkyLTE2OC04OS02NC51cy13ZXN0LTIuY29tcHV0ZS5pbnRlcm5hbDozOTUzMzQzODExNjox","tid":1056042,"in_init_tree":false},"function_name":"__arm64_sys_execve","args":[{"string_arg":"/bin/gzip","label":"filename"},{"bytes_arg":"","label":"argv"}],"action":"KPROBE_ACTION_POST","policy_name":"auditd-equivalent-security-monitoring","return_action":"KPROBE_ACTION_POST"},"node_name":"ip-192-168-89-64.us-west-2.compute.internal","time":"2025-10-06T00:00:46.054335518Z","cluster_name":"k8s-goat-cluster","node_labels":{"alpha.eksctl.io/cluster-name":"k8s-goat-cluster","alpha.eksctl.io/nodegroup-name":"ng-a99d40b1","beta.kubernetes.io/arch":"arm64","beta.kubernetes.io/instance-type":"t4g.medium","beta.kubernetes.io/os":"linux","eks.amazonaws.com/capacityType":"ON_DEMAND","eks.amazonaws.com/nodegroup":"ng-a99d40b1","eks.amazonaws.com/nodegroup-image":"ami-0339636baccc3c183","eks.amazonaws.com/sourceLaunchTemplateId":"lt-0da0169006f2a7c39","eks.amazonaws.com/sourceLaunchTemplateVersion":"1","failure-domain.beta.kubernetes.io/region":"us-west-2","failure-domain.beta.kubernetes.io/zone":"us-west-2c","k8s.io/cloud-provider-aws":"16c540d8ecc5192189b6444fb194814b","kubernetes.io/arch":"arm64","kubernetes.io/hostname":"ip-192-168-89-64.us-west-2.compute.internal","kubernetes.io/os":"linux","node.kubernetes.io/instance-type":"t4g.medium","topology.k8s.aws/zone-id":"usw2-az3","topology.kubernetes.io/region":"us-west-2","topology.kubernetes.io/zone":"us-west-2c"}}
+
+

detections/cloud/cisco_isovalent___cron_job_creation.yml

@@ -0,0 +1,68 @@
+name: Cisco Isovalent - Cron Job Creation
+id: 94531a31-a041-4777-909f-cd92ed3b71ad
+version: 1
+date: '2025-08-12'
+author: Bhavin Patel, Splunk
+type: Anomaly
+data_source:
+- Cisco Isovalent Process Exec
+status: production
+description: The following analytic detects the creation of a cron job within the Cisco Isovalent environment. It identifies this activity by monitoring process execution logs for cron job creation events. This behavior is significant for a SOC as it could allow an attacker to execute malicious tasks repeatedly and automatically, posing a threat to the Kubernetes infrastructure. If confirmed malicious, this activity could lead to persistent attacks, service disruptions, or unauthorized access to sensitive information.
+search: |
+  `cisco_isovalent_process_exec` process_name IN ("crond","cron","crontab")
+  | search pod_name!=""
+  | stats count 
+          min(_time) as firstTime 
+          max(_time) as lastTime 
+          values(process) as process
+      by cluster_name pod_name parent_process_name process_name process_exec process_id node_name
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `cisco_isovalent___cron_job_creation_filter`
+how_to_implement: The detection is based on process execution data generated by Cisco Isovalent Runtime Security. Ensure that Isovalent Runtime Security is deployed and configured in your Kubernetes environment to emit process_exec events. Configure the Cisco Security Cloud TA to collect these logs via HTTP Event Collector (HEC) and normalize them into the Splunk Common Information Model. This integration ensures that all relevant pod, container, and process activity is captured for monitoring and detection of suspicious behavior.
+known_false_positives: This activity may be triggered by legitimate administrative scripts, container images, or third-party operators that use cron for scheduled tasks, so please investigate the alert in context to rule out benign operations.
+references:
+- https://attack.mitre.org/techniques/T1053/003/
+- https://medium.com/@bag0zathev2/cronjobs-for-hackers-bugbounty-article-7d51588d0fd5
+- https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/
+drilldown_searches:
+- name: View the detection results for - "$pod_name$"
+  search: '%original_detection_search% | search user = "$pod_name$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: View risk events for the last 7 days for - "$pod_name$"
+  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$pod_name$")
+    starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime
+    values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
+    as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
+    as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+rba:
+  message: cron job creation detected in pod $pod_name$ in the cluster $cluster_name$
+  risk_objects:
+  - field: pod_name
+    type: system
+    score: 50
+  threat_objects:
+  - field: process_name
+    type: process_name
+tags:
+  analytic_story:
+  - Cisco Isovalent Suspicious Activity
+  asset_type: Kubernetes
+  mitre_attack_id:
+  - T1053.003
+  - T1053.007
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: network
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_isovalent/cisco_isovalent.log
+    source: not_applicable
+    sourcetype: cisco:isovalent:processExec