ralvares

# Kubernetes Tier 1 Threat Hunting Demo with Audit Logs

This is a full step-by-step demo for hunting Kubernetes threats using audit logs on an OpenShift cluster with access to `/var/log/kube-apiserver/audit.log`. It simulates a realistic attacker scenario where a pod is compromised and its ServiceAccount is used to escalate privileges and perform malicious actions.

All actions happen in the **`default` namespace**, and detections rely **only on verbs, resources, and subresources** — no assumptions about usernames, pod names, or namespaces.

---

## Step 0: Create Pod with kubectl and curl (Attacker foothold)

ralvares

How to Create and Attach a New Network to KVM VMs Using virsh

1. Create a New Libvirt Network

1.1 Define the Network in XML

Create a new file called new-network.xml with the following content:

<network>
  <name>custom-net</name>

ralvares

apiVersion: platform.stackrox.io/v1alpha1
kind: SecuredCluster
metadata:
  name: stackrox-secured-cluster-services
  namespace: stackrox
spec:
  sensor:
    resources:
      requests:
        cpu: 10m

ralvares

apiVersion: platform.stackrox.io/v1alpha1
kind: SecuredCluster
metadata:
  name: stackrox-secured-cluster-services
  namespace: stackrox
spec:
  customize:
    envVars:
      - name: ROX_SCANNER_V4_RED_HAT_CVES
        value: 'true'

ralvares

apiVersion: platform.stackrox.io/v1alpha1
kind: Central
metadata:
  name: stackrox-central-services
  namespace: stackrox
spec:
  customize:
    envVars:
      - name: ROX_EXTERNAL_IPS
        value: 'true'

ralvares

DOCKER_CONFIG_JSON=`oc extract secret/pull-secret -n openshift-config --to=-`

oc create secret generic multiclusterhub-operator-pull-secret \
   -n open-cluster-management-observability \
   --from-literal=.dockerconfigjson="$DOCKER_CONFIG_JSON" \
   --type=kubernetes.io/dockerconfigjson
   
ACCESS_KEY=""
SECRET_KEY=""

ralvares

if [ $# -eq 0 ]
then
echo  "try: $0 payments-v2 frontend backend"
exit 1
fi

> netpols.yaml

for namespace in $@
do

ralvares

apiVersion: platform.stackrox.io/v1alpha1
kind: SecuredCluster
metadata:
  name: stackrox-secured-cluster-services
  namespace: stackrox
spec:
  admissionControl:
    bypass: BreakGlassAnnotation
    contactImageScanners: DoNotScanInline
    listenOnCreates: true

ralvares

apiVersion: v1
kind: ServiceAccount
metadata:
  namespace: stackrox
  name: stackrox-image-puller
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: stackrox-image-puller-clusterrolebinding

ralvares

#!/bin/bash

if [[ -z "${ROX_ENDPOINT}" ]]; then
  echo >&2 "ROX_ENDPOINT must be set"
  exit 1
fi

if [[ -z "${ROX_API_TOKEN}" ]]; then
  echo >&2 "ROX_API_TOKEN must be set"
  exit 1