Detection rules › By catalog entry

Kubernetes-nodes

Catalog entry	Rules
get-nodes	2
list-nodes	2
watch-nodes	1
create-nodes	1
update-nodes	1
patch-nodes	1
get-nodes-proxy	4
create-nodes-proxy	4
update-nodes-proxy	3
patch-nodes-proxy	3
delete-nodes-proxy	3
any-nodes	1

get-nodes

2 detection rules reference this catalog entry. View catalog entry.

Elastic (2)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059,T1059.004,T1069,T1087,T1609,T1610
GKE Multi-Resource Discovery severity medium T1613

list-nodes

2 detection rules reference this catalog entry. View catalog entry.

Elastic (2)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059,T1059.004,T1069,T1087,T1609,T1610
GKE Multi-Resource Discovery severity medium T1613

watch-nodes

1 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059,T1059.004,T1069,T1087,T1609,T1610

create-nodes

1 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059,T1059.004,T1069,T1087,T1609,T1610

update-nodes

1 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059,T1059.004,T1069,T1087,T1609,T1610

patch-nodes

1 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059,T1059.004,T1069,T1087,T1609,T1610

get-nodes-proxy

4 detection rules reference this catalog entry. View catalog entry.

Elastic (4)

Azure AKS API Server Proxying Request to Kubelet severity medium T1210,T1609
Azure AKS Kubelet Proxy to Command Execution Endpoint severity high T1210,T1609
GKE API Server Proxying Request to Kubelet severity medium T1550,T1550.001,T1611,T1613
Kubernetes API Server Proxying Request to Kubelet severity medium T1550,T1550.001,T1611,T1613

create-nodes-proxy

4 detection rules reference this catalog entry. View catalog entry.

Elastic (4)

Azure AKS API Server Proxying Request to Kubelet severity medium T1210,T1609
Azure AKS Kubelet Proxy to Command Execution Endpoint severity high T1210,T1609
GKE API Server Proxying Request to Kubelet severity medium T1550,T1550.001,T1611,T1613
Kubernetes API Server Proxying Request to Kubelet severity medium T1550,T1550.001,T1611,T1613

update-nodes-proxy

3 detection rules reference this catalog entry. View catalog entry.

Elastic (3)

Azure AKS API Server Proxying Request to Kubelet severity medium T1210,T1609
Azure AKS Kubelet Proxy to Command Execution Endpoint severity high T1210,T1609
Kubernetes API Server Proxying Request to Kubelet severity medium T1550,T1550.001,T1611,T1613

patch-nodes-proxy

3 detection rules reference this catalog entry. View catalog entry.

Elastic (3)

Azure AKS API Server Proxying Request to Kubelet severity medium T1210,T1609
Azure AKS Kubelet Proxy to Command Execution Endpoint severity high T1210,T1609
Kubernetes API Server Proxying Request to Kubelet severity medium T1550,T1550.001,T1611,T1613

delete-nodes-proxy

3 detection rules reference this catalog entry. View catalog entry.

Elastic (3)

Azure AKS API Server Proxying Request to Kubelet severity medium T1210,T1609
Azure AKS Kubelet Proxy to Command Execution Endpoint severity high T1210,T1609
Kubernetes API Server Proxying Request to Kubelet severity medium T1550,T1550.001,T1611,T1613

any-nodes

1 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

Kubernetes Multi-Resource Discovery severity medium T1613

Back to all Kubernetes-nodes catalog entries