Sensitive namespace modified using kubectl

Documentos > Datadog Security > OOTB Rules > Sensitive namespace modified using kubectl

Classification:

attack

Tactic:

Technique:

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Goal

Detect the use of kubectl inside a container to modify the ConfigMap of a sensitive namespace.

Strategy

This detection triggers when kubectl is executed with specific arguments related to modifying the ConfigMap of a sensitive namespace.

Triage and response

Identify the purpose of the configuration being applied, and determine if it is authorized.
If it is not authorized, identify and revoke the credential used to authenticate to the Kubernetes API.
Initiate the incident response process.
Remediate compromised resources and repair the root cause.

Requires Agent version 7.27 or greater