panther-analysis

The Alpha Index includes comprehensive detection rules for Kubernetes clusters (EKS, AKS, GKE) focusing on cluster-wide security and pod-level isolation.

Key Detection Categories:

• Pod Security & Isolation: Detects pods using hostNetwork, hostPID, hostIPC, or hostPath mounts. It also alerts on pods with dangerous Linux capabilities (e.g., SYS_ADMIN, NET_ADMIN) and privileged pods.
• RBAC & Identity: Monitors for the creation of Roles/ClusterRoles with wildcard (*) permissions, write permissions to sensitive resources, or permissions for pods/exec and nodes/proxy. It also detects ClusterRoleBinding to privileged roles like cluster-admin.
• Secret Protection: Detects mass secret dumping across namespaces, repeated failed attempts to read secrets (potential brute-force), and single users accessing a high volume of distinct secrets (enumeration).
• API & Access: Detects anonymous API access, API requests from Tor exit nodes, and Kubernetes system principals being accessed from non-cloud public IP addresses.
• Persistence & Lateral Movement: Monitors for the creation/modification of CronJobs, DaemonSets, and AdmissionController webhooks, as well as kubectl cp operations used for data exfiltration.

The GCP index provides a collection of security rules designed to detect various attack vectors within Google Cloud Platform environments. These rules cover several categories of threats:

• Privilege Escalation: Detecting manual admin role assignments, IAM policy updates, service account key creation, and exploitation of Cloud Run or Cloud Build permissions.
• Data Exfiltration and Ransomware: Monitoring for bulk GCS object deletion, suspicious object rewrites (e.g., gsutil rewrite -k), cross-project GCS copies, and the upload of known ransomware note patterns.
• Infrastructure and Network Security: Detecting changes to firewall rules, DNS zones, VPC flow logs, and the creation of resources in unused geographic regions.
• Identity and Access Management (IAM): Monitoring for unexpected domain usage, external user ownership invites, and suspicious IAM/Tag enumeration.
• KMS Security: Detecting bulk encryption via GCS service accounts, cross-project encryption, and the destruction or disabling of KMS key versions.
• Logging Integrity: Alerting on the deletion of Log Buckets or Sinks and modifications to logging settings.

The Google Workspace index contains a variety of detection rules and scheduled queries designed to identify security threats within a Google Workspace environment. These include:

Authentication & Access Anomalies

• Brute Force Detection: Monitors for Brute Force By IP and Brute Force By User based on login denial thresholds.
• Login Anomalies: Detects Google Workspace Login Type Anomaly (new authentication methods), Google Workspace Rapid Multi-IP Authentication (3+ distinct IPv4 addresses within 6 hours), and Suspicious GSuite Login.
• Credential Theft: Specifically targets the GAIA GCPW Credential Theft Attack Chain (credential dumping on Windows followed by anomalous Workspace auth) and Google Workspace OAuth Token Requests from New IP.
• OAuth Security: Monitors for Google Workspace OAuth Application Authorized with Privileged Scopes and Google Workspace OAuth Login Scope Anomalous Application Access.

Data Protection & Drive Security

• File Sharing: Detects External GSuite File Share (sensitive files shared externally) and GSuite Document External Ownership Transfer.
• Mass Activity: Monitors for high volumes of activity via Google Drive High Download Count and GSuite Drive Many Documents Deleted.
• Visibility Changes: Detects when resources become public or overly visible via GSuite Calendar Has Been Made Public and GSuite External Drive Document.

Email Security (Gmail)

• Malicious Content: Detects Malware Detected in Email, Gsuite Attachments Downloaded from Spam Email, and Gsuite Link Clicked in Spam Email.
• Spoofing & Phishing: Monitors for Gmail Potential Spoofed Email Delivered (DMARC/SPF/DKIM failures) and Gsuite Email Bypassed Spam Filter.
• Spam Patterns: Detects Spam Email Surge (high volume of spam to a single user).

Administrative & Configuration Changes

• Role & Policy Changes: Detects Admin Role Assigned (manual privilege escalation), Google Workspace Admin Custom Role creation, and modifications to Google Workspace Advanced Protection Program or Google Workspace Apps Marketplace Allowlist.
• Security Settings: Monitors changes to GSuite Workspace Gmail Default Routing Rule, GSuite Workspace Gmail Security Sandbox, and GSuite Workspace Trusted Domain Allowlist.

Threat Intelligence Integration

• External Intelligence: Matches logs against GreyNoise V3 Malicious IP Activity, GTI/VirusTotal Threat Intelligence Indicator Match, and OTX Threat Intelligence Indicator Match (AlienVault OTX).
• Nation-State Threats: Detects GSuite Government Backed Attack based on specific indicators matching APT groups.

The Alpha Index contains a variety of security rules for Google Cloud Platform (GCP) designed to detect privilege escalation, ransomware, and unauthorized access.

Key Detection Categories:

• Privilege Escalation: Detects suspicious IAM changes, such as iam.roles.update, serviceAccounts.signJwt, serviceAccounts.signBlob, and serviceAccounts.getAccessToken. It also monitors for compute.instances.create and cloudrun.services.create patterns used to gain higher privileges.
• Ransomware & Data Destruction: Monitors for bulk GCS object deletions, GCS object rewrites (potential encryption), GCS ransom note uploads, and bulk KMS encryption operations.
• GKE & Kubernetes Security: Detects dangerous pod configurations like hostNetwork, hostPID, hostIPC, hostPath volume mounts, and privileged pods. It also monitors for exec into pods, kubectl cp operations, and unauthorized CronJob or DaemonSet creations.
• IAM & Access Control: Alerts on manual admin role assignments, external user ownership invites, and unauthorized changes to organization or folder policies.
• Network & Infrastructure: Detects VPC flow logs being disabled, firewall rule modifications, and DNS zone deletions.

A subset of the GCP index is dedicated to Kubernetes (GKE) security, focusing on cluster-level threats and pod-level escapes. Key detection areas include:

• Pod Security and Escapes: Detecting pods with hostNetwork, hostPID, or hostIPC enabled; pods using hostPath volume mounts; and pods with dangerous Linux capabilities (e.g., SYS_ADMIN, NET_ADMIN).
• Privileged Access: Monitoring for the creation of privileged pods, DaemonSets, or NodePort services that could bypass network controls.
• RBAC and Secret Security: Detecting the creation of roles with wildcard (*) permissions, roles with pods/exec or node proxy permissions, and mass secret enumeration or access denials.
• Persistence and Lateral Movement: Monitoring for new CronJobs, Admission Controller webhooks, or modifications to system roles.
• API Security: Detecting anonymous API access, API requests from Tor exit nodes, and kubectl cp operations used for data exfiltration.