Detection rules › By catalog entry

Kubernetes-deployments

Catalog entry	Rules
get-deployments	1
list-deployments	1
watch-deployments	1
create-deployments	5
update-deployments	1
patch-deployments	6
delete-deployments	1

get-deployments

1 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059,T1059.004,T1069,T1087,T1609,T1610

list-deployments

1 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059,T1059.004,T1069,T1087,T1609,T1610

watch-deployments

1 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059,T1059.004,T1069,T1087,T1609,T1610

create-deployments

5 detection rules reference this catalog entry. View catalog entry.

Elastic (5)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059,T1059.004,T1069,T1087,T1609,T1610
GKE Sensitive RBAC Change Followed by Workload Modification severity medium T1098,T1098.006
GKE Unusual Sensitive Workload Modification severity low T1098,T1098.006
Kubernetes Sensitive RBAC Change Followed by Workload Modification severity medium T1098,T1098.006
Unusual Kubernetes Sensitive Workload Modification severity low T1098,T1098.006

update-deployments

1 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059,T1059.004,T1069,T1087,T1609,T1610

patch-deployments

6 detection rules reference this catalog entry. View catalog entry.

Sigma (1)

Potential Sidecar Injection Into Running Deployment severity medium T1609

Elastic (5)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059,T1059.004,T1069,T1087,T1609,T1610
GKE Sensitive RBAC Change Followed by Workload Modification severity medium T1098,T1098.006
GKE Unusual Sensitive Workload Modification severity low T1098,T1098.006
Kubernetes Sensitive RBAC Change Followed by Workload Modification severity medium T1098,T1098.006
Unusual Kubernetes Sensitive Workload Modification severity low T1098,T1098.006

delete-deployments

1 detection rules reference this catalog entry. View catalog entry.

Sigma (1)

Deployment Deleted From Kubernetes Cluster severity low T1498

Back to all Kubernetes-deployments catalog entries