Analytics BIOC
Medium
✕
A Kubernetes API operation was successfully invoked by an anonymous user
An unauthenticated user successfully invoked API calls within the Kubernetes cluster.
- Module:
- Cortex Cloud
- Licensed by:
- Cloud Runtime Security (CRS)
- Data source:
- AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs
ATT&CK tactics: Initial Access (TA0001)
ATT&CK techniques: Valid Accounts: Default Accounts (T1078.001)
Detector tags: Kubernetes - API
Attacker's goals:
Gain initial access to a Kubernetes cluster.
Investigative actions:
Determine which resources were accessed anonymously. Verify whether the affected resource should be accessed by unauthenticated users.
- Test period:
- N/A (single event)
- Deduplication:
- 5 Days
1 variation:
- A Kubernetes API operation was successfully invoked by an anonymous user outside the cluster High (parent: Medium)