Analytics BIOC Informational
✕

Kubernetes API server communication from within a pod

The Kubernetes API server was accessed from within a pod.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Discovery (TA0007)
ATT&CK techniques: Container and Resource Discovery (T1613)
Detector tags: Kubernetes - AGENT
Attacker's goals:

Usage of the Kubernetes API server to perform operations inside the cluster.

Investigative actions:

Check if there is an active attack against the Kubernetes cluster.

Test period:
N/A (single event)
Deduplication:
5 Days
2 variations:
  • Unusual Kubernetes API server communication from within a pod performed by curl process Medium (parent: Informational)
  • Unusual Kubernetes API server communication from within a pod Low (parent: Informational)