Investigating Systems
- First time seen command line argument
- First time seen Windows service
- Sc.exe manipulating Windows services
- Child processes of Spoolsv.exe
- Windows accessibility binary modifications
- Registry keys used for privilege escalation
Investigating Connections
- DNS queries to randomized subdomains
- HTTP GET requests
- Uncommon top level domains
- DNS tunneling through randomized subdomains
- Algorithmically generated domain names
- Typosquatting clicks on a network
Investigating Users
- Volume of network traffic from one user
- Baseline of user logon times
- User account changed
- Files a user uploaded to a network file share
- Files that belong to a network user
- Suspicious domains visited by a user
Monitoring Systems
- Hosts logging data in a certain timeframe
- Hosts logging more or less data than expected
- Previously seen command line argument
- Previously seen Windows service
- Process creation events
- Processes running on a host
Monitoring Connections
- Amazon EKS Kubernetes cluster scan detection
- Amazon EKS Kubernetes pod scan detection
- Authentication logs for an endpoint
- Azure Kubernetes pod scan fingerprinting
- Azure Kubernetes scan fingerprinting
- Changes in DNS record type queries
Monitoring Users
- Kubernetes role-based access control authorizations
- Kubernetes sensitive roles
- Most active Kubernetes service accounts
- Kubernetes accounts accessing sensitive objects
- Kubernetes service accounts with failed or forbidden status
- Suspicious kubectl calls