Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Kubernetes Direct API Request via Curl or Wget

This rule monitors for the execution of curl or wget commands that directly access Kubernetes API endpoints, which may indicate an attempt to interact with Kubernetes resources in a potentially unauthorized manner. This technique is often used by adversaries to gather information about the Kubernetes environment, such as secrets, config maps, and other sensitive data, without using the official Kubernetes client tools such as "kubectl".

ATT&CK coverage

Outside the enterprise matrix

Detection requirements

Log source category: event_index

What the source says

Tagged by the source as

Data Source: Auditd ManagerData Source: CrowdstrikeData Source: Elastic DefendData Source: Elastic Defend for ContainersData Source: Elastic EndgameData Source: SentinelOneData Source: SysmonData Source: Windows Security Event LogsDomain: ContainerDomain: EndpointDomain: KubernetesOS: LinuxOS: macOSOS: WindowsResources: Investigation GuideTactic: DiscoveryTactic: ExecutionUse Case: Threat Detection

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.