Potential kubelet impersonation attempt

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	10 Minutes
Deduplication Period	1 Day
Required Data	XDR Agent with eXtended Threat Hunting (XTH)
Detector Tags	Kubernetes - AGENT, Kubernetes Credentials Theft Analytics
ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Unsecured Credentials: Credentials In Files (T1552.001)
Severity	Low

Description

A process accessed both the Kubelet credentials and the Kubernetes CA certificate, indicating an attempt to impersonate the node agent and communicate with the API server.

Attacker's Goals

Impersonate the node agent to gain control over the cluster.

Investigative actions

• Look for additional suspicious activities.
• Verify if the exposed credentials were used to access the API server.
• Investigate which operations were used against the Kubernetes cluster with the exposed credentials.

Variations

Potential kubelet impersonation attempt by an unusual process

Synopsis

Field	Value
ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Unsecured Credentials: Credentials In Files (T1552.001)
Severity	Medium

Description

A process accessed both the Kubelet credentials and the Kubernetes CA certificate, indicating an attempt to impersonate the node agent and communicate with the API server.

Attacker's Goals

Impersonate the node agent to gain control over the cluster.

Investigative actions

• Look for additional suspicious activities.
• Verify if the exposed credentials were used to access the API server.
• Investigate which operations were used against the Kubernetes cluster with the exposed credentials.