Securityalert Anomalous Access To Kubernetes Secret
KQL detection rule by ep3p · MIT
No description provided
SecurityAlert
| where AlertName has "Anomalous access to Kubernetes secret" and ProviderName == "Azure Security Center"
| summarize arg_min(TimeGenerated, *) by SystemAlertId
| extend ExtendedProperties = todynamic(ExtendedProperties)
| extend
UserName = tostring(ExtendedProperties["UserName"]),
UserAgent = tostring(ExtendedProperties["UserAgent"]),
Namespace = tostring(ExtendedProperties["Namespace"]),
RequestVerb = tostring(ExtendedProperties["RequestVerb"]),
SecretName = tostring(ExtendedProperties["SecretName"]),
RequestURI = tostring(ExtendedProperties["RequestURI"]),
ResourceType = tostring(ExtendedProperties["resourceType"])
// Clean Entities
| extend Entities = replace_regex(Entities, @'(\,\"\w+\"\:\{\"\$ref\"\:\"\d+\"\}|\"\w+\"\:\{\"\$ref\"\:\"\d+\"\}\,|\,\{\"\$ref\"\:\"\d+\"\})|\"\$id\"\:\"\d+\"\,', '')
| summarize
TimeGenerated = min(TimeGenerated),
StartTime = min(StartTime),
EndTime = max(EndTime),
UserAgents = make_set(UserAgent, 250),
SecretNames = make_set(SecretName, 250),
RequestURIs = make_set(RequestURI, 250),
AlertLinks = make_set(AlertLink, 250),
Entities = make_set(todynamic(Entities)),
take_any(RemediationSteps, Tactics, Techniques)
by AlertName, AlertSeverity, Description, ResourceId = tolower(ResourceId), Namespace, UserName, RequestVerb, ResourceType
| project
TimeGenerated,
AlertName,
AlertSeverity,
Description,
RemediationSteps,
ResourceId,
ResourceType,
StartTime,
EndTime,
UserName,
UserAgents,
Namespace,
RequestVerb,
SecretNames,
RequestURIs,
AlertLinks,
Tactics,
Techniques,
Entities