Skip to main content
Splunk Lantern

Azure Kubernetes pod scan fingerprinting

Kubernetes pods are a group of one or more containers with shared storage and a specification for how to run the containers. A pod's contents are always co-located and co-scheduled. You might want to look for fingerprinting scans against Kubernetes pods when doing the following:

Prerequisites 

In order to execute this procedure in your environment, the following data, services, or apps are required:

Example

One of your concerns with using Kubernetes is fingerprinting. You want to know if your pods are being targeted, and, if so, to get details about the files or directories being probed.

To optimize the search shown below, you should specify an index and a time range.

  1. Ensure that you have configured Kube-Audit data diagnostics in the Splunk Add-on for Microsoft Cloud Services.
  2. Run the following search: 
sourcetype:mscs:storage:blob:json category=kube-audit 
| spath input=properties.log 
| search responseStatus.code=401 
| table sourceIPs{} userAgent verb requestURI responseStatus.reason properties.pod 

Search explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Splunk Search Explanation

sourcetype:mscs:storage:blob:json

Search only the source type mscs:storage:blob:json.

category=kube-audit

Search the data source kube-audit from the diagnostic logs in Azure Cloud services.

| spath input=properties.log 

Pull information from this specific Kubernetes audit log.

| search responseStatus.code=401 

Search for HTTP Status 401, an unauthorized request.

| table sourceIPs{} userAgent verb requestURI responseStatus.reason properties.pod 

Display the results in a table with columns in the order shown.

Result

The results provide an IP address, user agent, verb, request URI, and response status. Not all unauthenticated requests are malicious, but these strings can provide clues of the type of tool being used for scanning. Watch for IP addresses flagged as malicious by popular IP reputation lists, such as Team Cymru, and analyze the HTTP verb in relation to the user agent, suspicious IP address, and the target URI to understand the intentions of detected scans.

For additional information about this search, such as its applicability to common frameworks and standards, see this project on GitHub.

  • Was this article helpful?