Unusual Kubernetes dashboard communication from a pod
Synopsis
Field
Value
Activation Period
14 Days
Training Period
30 Days
Test Period
N/A (single event)
Deduplication Period
1 Day
Required Data
XDR Agent
Detector Tags
Kubernetes - AGENT
ATT&CK Tactic
Discovery (TA0007)
ATT&CK Technique
Container and Resource Discovery (T1613)
Severity
Low
Description
The Kubernetes dashboard was accessed by an unusual pod within the environment.
Attacker's Goals
Usage of the Kubernetes dashboard to perform operations inside the cluster.
Investigative actions
Check if there is an active attack against the Kubernetes cluster.
Variations
Was this helpful?