1 Rebuilding the Kubernetes Threat Matrix and Validating Attack Detection by Falco Summer Internship 2022 @hi120ki

2 @hi120ki Hiroki Akamatsu / Security Engineering ● Full Name : 赤松宏紀 (Hiroki Akamatsu) ● GitHub : hi120ki ● Twitter : hi120ki ● Joining Time : 2022/08/16 ● Career : M1 student @Osaka University

3 What I have done Re-evaluate Sysdig Secure

4 Sysdig Secure SaaS for Kubernetes Security Attack detection by Falco Record container activity Container image scan Kubernetes audit log

5 How to attack Kubernetes? Before thinking about detection, we have to know

6 How to attack Kubernetes? Microsoft’s Threat Matrix includes all of attack techniques to Kubernetes https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/

7 How to attack Kubernetes? Rebuild the Kubernetes Threat Matrix

8 Falco Syscall based attack detection OSS Linux Kernel Falco probe Process Process syscall syscall Syscall execute open files, network connections, spawn new process, etc Catch and analyze syscall → Detect secret file read, malicious network access, spawn malicious process, etc

9 Contribute to Falco OSS Validating attack detection by Falco with Rebuilded Kubernetes Threat Matrix Add attack detection rules ・Add read environment variable from /proc files - falco#2193 ・Add rule to detect bypass by symlink files - falco#2202 ・Add containerd.sock to sensitive_vol_mount - k8saudit#146 ・Add Launch Excessively Capable Pod into k8saudit rule - k8saudit#147 Fix attack detection rules ・Add GKE default pod into allowlist in Mount Launched rule - falco#2198 ・Fix mount detection in falco_rules.yaml - falco#2199 ・Fix k8saudit rule EphemeralContainers Created - k8saudit#151 Fix ・Add ka.sourceips in k8saudit plugin - k8saudit#143 ・Add userAgent to auditEvent - stackdriver-webhook-bridge#16 Created 9PR to OSS Contribute not only Mercari but Kubernetes Security

10 Published a blog post！ https://engineering.mercari.com/blog/entry/20220928-kubern etes-threat-matrix-and-attack-detection-by-falco/