Detection rules › Falco
Create/Modify Configmap With Private Credentials
Detect creating/modifying a configmap containing a private credential (aws key, password, etc.)
Telemetry coverage
Rules detecting the same action
These rules filter on the same operation.
- Azure AKS CoreDNS or Kube-DNS Configuration Modified (Elastic)
- Direct Interactive Kubernetes API Request by Unusual Utilities (Elastic)
- EKS Authentication Configuration Modified (Elastic)
- GKE CoreDNS or Kube-DNS Configuration Modified (Elastic)
- K8s ConfigMap Created (Falco)
- Kubernetes CoreDNS or Kube-DNS Configuration Modified (Elastic)
- Kubernetes Secret or ConfigMap Access via Azure Arc Proxy (Elastic)
Stages and Predicates
Stage 1: falco_condition
and
or
requestObject.configmap.obj contains "aws-access-key-id"
requestObject.configmap.obj contains "aws-s3-access-key-id"
requestObject.configmap.obj contains "aws_access_key_id"
requestObject.configmap.obj contains "aws_s3_access_key_id"
requestObject.configmap.obj contains "passphrase"
requestObject.configmap.obj contains "password"
objectRef.resource eq "configmaps"
stage eq "ResponseComplete"
verb in ["create", "patch", "update"]
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
objectRef.resource | eq |
| field:"objectRef.resource" kind:eq value:"configmaps" |
requestObject.configmap.obj | contains |
| field:"requestObject.configmap.obj" kind:contains |
stage | in |
| field:"stage" kind:in value:"ResponseComplete" |
verb | in |
| field:"verb" kind:in |