Analytics BIOC Low
✕

Unusual Kubernetes dashboard communication from a pod

The Kubernetes dashboard was accessed by an unusual pod within the environment.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Discovery (TA0007)
ATT&CK techniques: Container and Resource Discovery (T1613)
Detector tags: Kubernetes - AGENT
Attacker's goals:

Usage of the Kubernetes dashboard to perform operations inside the cluster.

Investigative actions:

Check if there is an active attack against the Kubernetes cluster.

Test period:
N/A (single event)
Deduplication:
1 Day
1 variation:
  • Unusual Kubernetes dashboard communication from a new pod Informational (parent: Low)