Detection rules › By event

Kubernetes-configmaps

Event	Rules
get-configmaps	3
list-configmaps	3
watch-configmaps	1
create-configmaps	5
update-configmaps	7
patch-configmaps	7
delete-configmaps	6
any-configmaps	2

get-configmaps

3 detection rules reference this event. View event page.

Elastic (3)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
GKE Multi-Resource Discovery severity medium T1613
Kubernetes Secret or ConfigMap Access via Azure Arc Proxy severity medium T1213, T1530, T1552, T1552.007, T1565, T1565.001

list-configmaps

3 detection rules reference this event. View event page.

Elastic (3)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
GKE Multi-Resource Discovery severity medium T1613
Kubernetes Secret or ConfigMap Access via Azure Arc Proxy severity medium T1213, T1530, T1552, T1552.007, T1565, T1565.001

watch-configmaps

1 detection rules reference this event. View event page.

Elastic (1)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610

create-configmaps

5 detection rules reference this event. View event page.

Elastic (3)

Azure AKS CoreDNS or Kube-DNS Configuration Modified severity medium T1557
Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
Kubernetes Secret or ConfigMap Access via Azure Arc Proxy severity medium T1213, T1530, T1552, T1552.007, T1565, T1565.001

Falco (2)

Create/Modify Configmap With Private Credentials severity WARNING
K8s ConfigMap Created severity INFO

update-configmaps

7 detection rules reference this event. View event page.

Elastic (6)

Azure AKS CoreDNS or Kube-DNS Configuration Modified severity medium T1557
Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
EKS Authentication Configuration Modified severity high T1098, T1098.006
GKE CoreDNS or Kube-DNS Configuration Modified severity high T1565, T1565.001
Kubernetes CoreDNS or Kube-DNS Configuration Modified severity high T1565, T1565.001
Kubernetes Secret or ConfigMap Access via Azure Arc Proxy severity medium T1213, T1530, T1552, T1552.007, T1565, T1565.001

Falco (1)

Create/Modify Configmap With Private Credentials severity WARNING

patch-configmaps

7 detection rules reference this event. View event page.

Elastic (6)

Azure AKS CoreDNS or Kube-DNS Configuration Modified severity medium T1557
Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
EKS Authentication Configuration Modified severity high T1098, T1098.006
GKE CoreDNS or Kube-DNS Configuration Modified severity high T1565, T1565.001
Kubernetes CoreDNS or Kube-DNS Configuration Modified severity high T1565, T1565.001
Kubernetes Secret or ConfigMap Access via Azure Arc Proxy severity medium T1213, T1530, T1552, T1552.007, T1565, T1565.001

Falco (1)

Create/Modify Configmap With Private Credentials severity WARNING

delete-configmaps

6 detection rules reference this event. View event page.

Elastic (5)

Azure AKS CoreDNS or Kube-DNS Configuration Modified severity medium T1557
EKS Authentication Configuration Modified severity high T1098, T1098.006
GKE CoreDNS or Kube-DNS Configuration Modified severity high T1565, T1565.001
Kubernetes CoreDNS or Kube-DNS Configuration Modified severity high T1565, T1565.001
Kubernetes Secret or ConfigMap Access via Azure Arc Proxy severity medium T1213, T1530, T1552, T1552.007, T1565, T1565.001

Falco (1)

K8s ConfigMap Deleted severity INFO

any-configmaps

2 detection rules reference this event. View event page.

Elastic (2)

Kubernetes Multi-Resource Discovery severity medium T1613
Kubernetes Unusual Decision by User Agent severity low T1078