Detection rules › By catalog entry

Kubernetes-configmaps

Catalog entry	Rules
get-configmaps	3
list-configmaps	3
watch-configmaps	1
create-configmaps	3
update-configmaps	6
patch-configmaps	6
delete-configmaps	5
any-configmaps	1

get-configmaps

3 detection rules reference this catalog entry. View catalog entry.

Elastic (3)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059,T1059.004,T1069,T1087,T1609,T1610
GKE Multi-Resource Discovery severity medium T1613
Kubernetes Secret or ConfigMap Access via Azure Arc Proxy severity medium T1213,T1530,T1552,T1552.007,T1565,T1565.001

list-configmaps

3 detection rules reference this catalog entry. View catalog entry.

Elastic (3)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059,T1059.004,T1069,T1087,T1609,T1610
GKE Multi-Resource Discovery severity medium T1613
Kubernetes Secret or ConfigMap Access via Azure Arc Proxy severity medium T1213,T1530,T1552,T1552.007,T1565,T1565.001

watch-configmaps

1 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059,T1059.004,T1069,T1087,T1609,T1610

create-configmaps

3 detection rules reference this catalog entry. View catalog entry.

Elastic (3)

Azure AKS CoreDNS or Kube-DNS Configuration Modified severity medium T1557
Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059,T1059.004,T1069,T1087,T1609,T1610
Kubernetes Secret or ConfigMap Access via Azure Arc Proxy severity medium T1213,T1530,T1552,T1552.007,T1565,T1565.001

update-configmaps

6 detection rules reference this catalog entry. View catalog entry.

Elastic (6)

Azure AKS CoreDNS or Kube-DNS Configuration Modified severity medium T1557
Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059,T1059.004,T1069,T1087,T1609,T1610
EKS Authentication Configuration Modified severity high T1098,T1098.006
GKE CoreDNS or Kube-DNS Configuration Modified severity high T1565,T1565.001
Kubernetes CoreDNS or Kube-DNS Configuration Modified severity high T1565,T1565.001
Kubernetes Secret or ConfigMap Access via Azure Arc Proxy severity medium T1213,T1530,T1552,T1552.007,T1565,T1565.001

patch-configmaps

6 detection rules reference this catalog entry. View catalog entry.

Elastic (6)

Azure AKS CoreDNS or Kube-DNS Configuration Modified severity medium T1557
Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059,T1059.004,T1069,T1087,T1609,T1610
EKS Authentication Configuration Modified severity high T1098,T1098.006
GKE CoreDNS or Kube-DNS Configuration Modified severity high T1565,T1565.001
Kubernetes CoreDNS or Kube-DNS Configuration Modified severity high T1565,T1565.001
Kubernetes Secret or ConfigMap Access via Azure Arc Proxy severity medium T1213,T1530,T1552,T1552.007,T1565,T1565.001

delete-configmaps

5 detection rules reference this catalog entry. View catalog entry.

Elastic (5)

Azure AKS CoreDNS or Kube-DNS Configuration Modified severity medium T1557
EKS Authentication Configuration Modified severity high T1098,T1098.006
GKE CoreDNS or Kube-DNS Configuration Modified severity high T1565,T1565.001
Kubernetes CoreDNS or Kube-DNS Configuration Modified severity high T1565,T1565.001
Kubernetes Secret or ConfigMap Access via Azure Arc Proxy severity medium T1213,T1530,T1552,T1552.007,T1565,T1565.001

any-configmaps

1 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

Kubernetes Multi-Resource Discovery severity medium T1613

Back to all Kubernetes-configmaps catalog entries