Merge pull request #858 from splunk/kubernetes_pull_image

Kubernetes Pull Image
splunk · Dec 7, 2023 · 545c627 · 545c627
2 parents f4be4ca + 7adf0b1
commit 545c627
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 0 deletions.
diff --git a/...sets/attack_techniques/T1526/kubernetes_audit_pull_image/kubernetes_audit_pull_image.json b/...sets/attack_techniques/T1526/kubernetes_audit_pull_image/kubernetes_audit_pull_image.json
diff --git a/datasets/attack_techniques/T1526/kubernetes_audit_pull_image/kubernetes_audit_pull_image.yml b/datasets/attack_techniques/T1526/kubernetes_audit_pull_image/kubernetes_audit_pull_image.yml
@@ -0,0 +1,11 @@
+author: Patrick Bareiss
+id: 38e470fb-3c73-42c5-a5e6-47838df5e62e
+date: '2023-12-07'
+description: Kubernetes audit logs which contains pulling a image.
+environment: attack_range
+dataset:
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1526/kubernetes_audit_pull_image/kubernetes_audit_pull_image.json
+sourcetypes:
+- aws:cloudwatchlogs
+references:
+- https://attack.mitre.org/techniques/T1526