Azure Kubernetes pod scan fingerprinting

Kubernetes pods are a group of one or more containers with shared storage and a specification for how to run the containers. A pod's contents are always co-located and co-scheduled. You might want to look for fingerprinting scans against Kubernetes pods when doing the following:

• Detecting Kubernetes scanning activity

Prerequisites 

In order to execute this procedure in your environment, you may need to first on-board the services or apps shown in the following table.

Example

The purpose of this example is to show how this procedure works in a general environment. In your environment, you can optimize the search by specifying an index, a time range, or a different data source. 

One of your concerns with using Kubernetes is fingerprinting. You want to know if your pods are being targeted, and, if so, to get details about the files or directories being probed.

1. Ensure that you have configured Kube-Audit data diagnostics in the Splunk Add-on for Microsoft Cloud Services.
2. Run the following search: 

sourcetype:mscs:storage:blob:json category=kube-audit 
|spath input=properties.log 
|search responseStatus.code=401 
|table sourceIPs{} userAgent verb requestURI responseStatus.reason properties.pod 

Search Explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Result

The results provide an IP address, user agent, verb, request URI, and response status. Not all unauthenticated requests are malicious, but these strings can provide clues of the type of tool being used for scanning. Watch for IP addresses flagged as malicious by popular IP reputation lists, such as Team Cymru, and analyze the HTTP verb in relation to the user agent, suspicious IP address, and the target URI to understand the intentions of detected scans.

For additional information about this search, such as its applicability to common frameworks and standards, see this project on GitHub.