Admin tools¶
Do not allow execution of administrative/maintenance tools inside the pods.
Narrative¶
Adversaries may abuse a container administration service to execute commands within a container. A container administration service such as the Docker daemon, the Kubernetes API server, or the kubelet may allow remote management of containers within an environment.
Attack Scenario¶
It's important to note that attackers with permissions could potentially run 'kubectl exec' to execute malicious code and compromise resources within a cluster. It's crucial to monitor the activity within the cluster and take proactive measures to prevent these attacks from occurring.
Attack Type Command Injection, Lateral Movements, etc.
Actual Attack Target cyberattack, Supply Chain Attacks
Compliance¶
- NIST_800-53_AU-2
- MITRE_T1609_container_administration_command
- NIST_800-53_SI-4
Policy¶
Admin tools¶
apiVersion: security.kubearmor.com/v1
kind: KubeArmorPolicy
metadata:
name: harden-dvwa-web-k8s-client-tool-exec
namespace: default
spec:
action: Block
message: Alert! k8s client tool executed inside container.
process:
matchPaths:
- path: /usr/local/bin/kubectl
- path: /usr/bin/kubectl
- path: /usr/local/bin/docker
- path: /usr/bin/docker
- path: /usr/local/bin/crictl
- path: /usr/bin/crictl
selector:
matchLabels:
app: dvwa-web
tier: frontend
severity: 5
tags:
- MITRE_T1609_container_administration_command
- MITRE_TA0002_execution
- MITRE_T1610_deploy_container
- MITRE
- NIST_800-53
- NIST_800-53_AU-2
- NIST_800-53_SI-4
- NIST
Simulation¶
kubectl exec -it dvwa-web-566855bc5b-4j4vl -- bash
root@dvwa-web-566855bc5b-4j4vl:/var/www/html# kubectl
bash: /usr/bin/kubectl: Permission denied
root@dvwa-web-566855bc5b-4j4vl:/var/www/html#
Expected Alert¶
{
"ATags": null,
"Action": "Block",
"ClusterName": "aditya",
"ContainerID": "32015ebeea9e1f4d4e7dbf6608c010ef2b34c48f1af11a5c6f0ea2fd27c6ba6c",
"ContainerImage": "docker.io/cytopia/dvwa:php-8.1@sha256:f7a9d03b1dfcec55757cc39ca2470bdec1618b11c4a51052bb4f5f5e7d78ca39",
"ContainerName": "dvwa",
"Data": "syscall=SYS_EXECVE",
"Enforcer": "AppArmor",
"HashID": "1167b21433f2a4e78a4c6875bb34232e6a2b3c8535e885bb4f9e336fd2801d92",
"HostName": "aditya",
"HostPID": 38035,
"HostPPID": 37878,
"Labels": "tier=frontend,app=dvwa-web",
"Message": "",
"NamespaceName": "default",
"Operation": "Process",
"Owner": {
"Name": "dvwa-web",
"Namespace": "default",
"Ref": "Deployment"
},
"PID": 554,
"PPID": 548,
"PodName": "dvwa-web-566855bc5b-4j4vl",
"PolicyName": "DefaultPosture",
"ProcessName": "/usr/bin/kubectl",
"Resource": "/usr/bin/kubectl",
"Result": "Permission denied",
"Severity": "",
"Source": "/bin/bash",
"Tags": "",
"Timestamp": 1696326880,
"Type": "MatchedPolicy",
"UID": 0,
"UpdatedTime": "2023-10-03T09:54:40.056501Z",
"cluster_id": "3896",
"component_name": "kubearmor",
"instanceGroup": "0",
"instanceID": "0",
"workload": "1"
}