Detection Engineering in Kubernetes Environments: Wrangling Security Data Out of You...
summary
Claims that defenders need two minimum data sources — runtime syscall/CIS-call instrumentation and Kubernetes audit logs — and shows concrete detections and tuning steps. Cites MITRE ATT&CK for Containers and a UCSB internet-exposed cluster study that found automated control‑plane crawlers. Demonstrates detecting kubectl exec by the audit log objectRef subresource “exec” and URL‑encoded command, spotting a privileged container via securityContext. Covers secret‑list detections (list without namespace), noise reduction by environment-aware filtering, clustering alerts, and baking on‑call/context into rules.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:23Why build Kubernetes detection engineering
- 4:56Kubernetes attack threat model
- 6:18Essential Kubernetes data sources
- 7:42Challenges with CIS call detection
- 9:50Kubernetes audit logs explained
- 12:57Key fields in audit logs
- 15:26Managing audit log volume
- 17:11Environment norms for detection
- 18:13Offensive tooling for detection
- 20:17Common detection pitfalls
- 21:21Detecting exec to production
- 22:45Detecting privileged containers
- 24:54Detecting secret retrieval
- 28:00Key takeaways and conclusion
related talks
30mEffective Detection in Kubernetes Clusters
43mKubernetes Security: Attacking and Defending Modern Infrastructure
20mUncovering a Sophisticated Kubernetes Attack in Real-Time
29mKubernetes Security: Attacking and Defending K8s Clusters
38mKubernetes Security: Attacking and Defending K8s Clusters
49mAttacking and Detecting Attacks on Kubernetes Clusters
57mPreventing Attacks at Scale
26mHacking into Kubernetes Security for Beginners