Configure Security Command Center services

Google Kubernetes Engine

Added Binary Executed
Added Library Loaded
Command and Control: Steganography Tool Detected
Credential Access: Failed Attempt to Approve Kubernetes Certificate Signing Request (CSR)
Credential Access: Find Google Cloud Credentials
Credential Access: GPG Key Reconnaissance
Credential Access: Manually Approved Kubernetes Certificate Signing Request (CSR)
Credential Access: Search Private Keys or Passwords
Credential Access: Secrets Accessed In Kubernetes Namespace
Defense Evasion: Base64 ELF File Command Line
Defense Evasion: Base64 Encoded Python Script Executed
Defense Evasion: Base64 Encoded Shell Script Executed
Defense Evasion: Breakglass Workload Deployment Created
Defense Evasion: Breakglass Workload Deployment Updated
Defense Evasion: Launch Code Compiler Tool In Container
Defense Evasion: Manually Deleted Certificate Signing Request (CSR)
Defense Evasion: Potential Kubernetes Pod Masquerading
Defense Evasion: Static Pod Created
Discovery: Can get sensitive Kubernetes object check
Execution: Added Malicious Binary Executed
Execution: Added Malicious Library Loaded
Execution: Built in Malicious Binary Executed
Execution: Container Escape
Execution: Fileless Execution in /memfd:
Execution: GKE launch excessively capable container
Execution: Ingress Nightmare Vulnerability Exploitation
Execution: Kubernetes Attack Tool Execution
Execution: Kubernetes Pod Created with Potential Reverse Shell Arguments
Execution: Local Reconnaissance Tool Execution
Execution: Malicious Python executed
Execution: Modified Malicious Binary Executed
Execution: Modified Malicious Library Loaded
Execution: Netcat Remote Code Execution in Container
Execution: Possible Arbitrary Command Execution through CUPS (CVE-2024-47177)
Execution: Possible Remote Command Execution Detected
Execution: Program Run with Disallowed HTTP Proxy Env
Execution: Socat Reverse Shell Detected
Execution: Suspicious Exec or Attach to a System Pod
Execution: Suspicious OpenSSL Shared Object Loaded
Execution: Workload triggered in sensitive namespace
Exfiltration: Launch Remote File Copy Tools in Container
Impact: Detect Malicious Cmdlines
Impact: GKE kube-dns modification detected
Impact: Remove Bulk Data From Disk
Impact: Suspicious Kubernetes Container Names - Cryptocurrency Mining
Impact: Suspicious crypto mining activity using the Stratum Protocol
Initial Access: Anonymous GKE Resource Created from the Internet
Initial Access: GKE NodePort service created
Initial Access: GKE Resource Modified Anonymously from the Internet
Initial Access: Successful API call made from a TOR proxy IP
Malicious Script Executed
Malicious URL Observed
Persistence: GKE Webhook Configuration Detected
Persistence: Service Account Created in sensitive namespace
Privilege Escalation: Abuse of Sudo For Privilege Escalation (CVE-2019-14287)
Privilege Escalation: Changes to sensitive Kubernetes RBAC objects
Privilege Escalation: ClusterRole with Privileged Verbs
Privilege Escalation: ClusterRoleBinding to Privileged Role
Privilege Escalation: Create Kubernetes CSR for master cert
Privilege Escalation: Creation of sensitive Kubernetes bindings
Privilege Escalation: Effectively Anonymous Users Granted GKE Cluster Access
Privilege Escalation: Fileless Execution in /dev/shm
Privilege Escalation: Get Kubernetes CSR with compromised bootstrap credentials
Privilege Escalation: Launch of privileged Kubernetes container
Privilege Escalation: Polkit Local Privilege Escalation Vulnerability (CVE-2021-4034)
Privilege Escalation: Sudo Potential Privilege Escalation (CVE-2021-3156)
Privilege Escalation: Suspicious Kubernetes Container Names - Exploitation and Escape
Privilege Escalation: Workload Created with a Sensitive Host Path Mount
Privilege Escalation: Workload with shareProcessNamespace enabled
Reverse Shell
Unexpected Child Shell