mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-08-31 13:40:50 +03:00
Mahipal
6972fe933e
All 33 container-security skills now carry what it does, an explicit "Use when" trigger, keywords, and a negative trigger naming the nearest neighbour. Six collision clusters resolved by differentiating scope rather than merging, so no skill is removed: - kube-bench: running the tool vs interpreting findings into an audit - Calico: portable upstream NetworkPolicy vs Calico-as-CNI vs Calico-only CRDs (GlobalNetworkPolicy, HostEndpoint, DNS egress) - Falco: deploying and operating it vs authoring escape rules - container escape: tool-agnostic runtime signals vs Falco rule syntax vs static posture audit vs offensive breakout - Trivy: all-target platform and operator vs single-image scan - Docker: images and Dockerfiles vs daemon.json vs the CIS audit script Also replaces the templated "When to Use" boilerplate in these files, including bullets that only restated the skill's own name. Worst pair (Pod Security Standards vs Pod Security Admission) drops from 0.77 cosine to below the 0.45 threshold. Repo-wide: colliding pairs 60 -> 56, skills involved 105 -> 94.
87 lines
2.6 KiB
Markdown
87 lines
2.6 KiB
Markdown
---
|
|
name: analyzing-kubernetes-audit-logs
|
|
description: >-
|
|
Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access,
|
|
RBAC modifications, privileged pod creation, and anonymous API access, and builds SIEM
|
|
detection rules from the event patterns. Use when investigating a suspected cluster
|
|
compromise, reconstructing what an attacker did through the API server, or writing
|
|
Kubernetes-specific detection content. Keywords: audit policy, audit log, kube-apiserver,
|
|
exec into pod, RBAC change, anonymous access, detection rules. Do not use for syscall-level
|
|
detection inside a running container - use detecting-container-runtime-threats-with-falco.
|
|
|
|
'
|
|
domain: cybersecurity
|
|
subdomain: container-security
|
|
tags:
|
|
- kubernetes-security
|
|
- container-security
|
|
- audit-log-analysis
|
|
- rbac
|
|
- privilege-escalation
|
|
- k8s-api-server
|
|
- threat-detection
|
|
version: '1.0'
|
|
author: mahipal
|
|
license: Apache-2.0
|
|
nist_csf:
|
|
- PR.PS-01
|
|
- PR.IR-01
|
|
- ID.AM-08
|
|
- DE.CM-01
|
|
mitre_attack:
|
|
- T1610
|
|
- T1613
|
|
- T1078
|
|
- T1552.007
|
|
---
|
|
|
|
# Analyzing Kubernetes Audit Logs
|
|
|
|
|
|
## When to Use
|
|
|
|
- When investigating security incidents that require analyzing kubernetes audit logs
|
|
- When building detection rules or threat hunting queries for this domain
|
|
- When SOC analysts need structured procedures for this analysis type
|
|
- When validating security monitoring coverage for related attack techniques
|
|
|
|
## Prerequisites
|
|
|
|
- Familiarity with container security concepts and tools
|
|
- Access to a test or lab environment for safe execution
|
|
- Python 3.8+ with required dependencies installed
|
|
- Appropriate authorization for any testing activities
|
|
|
|
## Instructions
|
|
|
|
Parse Kubernetes audit log files (JSON lines format) to detect security-relevant
|
|
events including unauthorized access, privilege escalation, and data exfiltration.
|
|
|
|
```python
|
|
import json
|
|
|
|
with open("/var/log/kubernetes/audit.log") as f:
|
|
for line in f:
|
|
event = json.loads(line)
|
|
verb = event.get("verb")
|
|
resource = event.get("objectRef", {}).get("resource")
|
|
user = event.get("user", {}).get("username")
|
|
if verb == "create" and resource == "pods/exec":
|
|
print(f"Pod exec by {user}")
|
|
```
|
|
|
|
Key events to detect:
|
|
1. pods/exec and pods/attach (shell into containers)
|
|
2. secrets access (get/list/watch)
|
|
3. clusterrolebindings creation (RBAC escalation)
|
|
4. Privileged pod creation
|
|
5. Anonymous or system:unauthenticated access
|
|
|
|
## Examples
|
|
|
|
```python
|
|
# Detect secret enumeration
|
|
if verb in ("get", "list") and resource == "secrets":
|
|
print(f"Secret access: {user} -> {event['objectRef'].get('name')}")
|
|
```
|