Effective Detection in Kubernetes Clusters
summary
Demo shows initial access from a Jupyter notebook, in-cluster execution of kubectl, deployment of an xmrig miner, extraction of an EKS pod identity token and use of AWS API credentials to list and download from three S3 buckets. Detection claims: combine Kubernetes audit logs, admission webhooks, runtime sensors and cloud audit feeds. Runtime sensor captures process, file, network and memory events and can kill processes and collect forensics. Demo succeeds and authors argue full detection only works by correlating those sources.
AI-written summary · about
chapters (18)
- 0:00Introduction to talk
- 1:23Speaker introductions
- 2:26Kubernetes attack chain overview
- 3:08Modern attack trends
- 4:34Effective detection approach
- 5:38Kubernetes audit logs
- 7:46Audit log challenges
- 8:48Rule trivia on audit logs
- 9:53Admission webhooks for detection
- 11:18Reducing webhook noise
- 12:42Cloud logs and enrichment
- 15:10Runtime sensor overview
- 17:18Runtime sensor instrumentation
- 20:57Runtime sensor deployment
- 22:43Live attack demonstration
- 26:17Demo attack stage analysis
- 28:25Multi-dimensional detection solution
- 29:27Q&A on false positives
related talks
29mDetection Engineering in Kubernetes Environments: Wrangling Security Data Out of You...
20mUncovering a Sophisticated Kubernetes Attack in Real-Time
29mKubernetes Security: Attacking and Defending K8s Clusters
38mKubernetes Security: Attacking and Defending K8s Clusters
57mPreventing Attacks at Scale
49mAttacking and Detecting Attacks on Kubernetes Clusters
37mProactive Kubernetes Security: Anomaly Detection and Runtime Alertin...
38mKubernetes Security: Attacking and Defending K8s Clusters