undle, ASC threat protection monitors the AKS cluster for suspicious activity. You can enable the bundle in ASC by following these steps:

1. Navigate to Pricing & settings
2. Choose a subscription
3. Ensure Kubernetes is enabled as a resource type (see the image below)
https://lh5.googleusercontent.com/jcgkz-x4MhRrHoR4x8Xb8YMnLUJQ1JYY5EiscO6YnhabPsaehZJkkrE05QcJVFktHX8goRahZjmGihCrLcwxe28CBAZXqF-uTYlUKOFon9SGw74pdgT7zTbbei9l3ecFVEjOaXpYg4I0YTs30JwTs9ikEEj4nz2RhAU5sFsHi-UnwTvuR1G_D48
If you already connected ASC threat alerts to your Sentinel workspace using the native ASC connector, these AKS alerts are sent directly into Sentinel. ASC can detect various threats in AKS clusters, including containers with a sensitive volume mount, an exposed Kubernetes dashboard, and digital currency mining containers. Azure Diagnostics LogsAzure Diagnostic Logs are logs that are emitted by resources in Azure and provide insights into the operation of those resources. Diagnostic logs can be used to troubleshoot issues, monitor the health of resources, and identify patterns of usage.

There are several types of diagnostic logs that can be collected in Azure:

* Activity logs: These logs provide information about the operations that have been performed on a resource.
* Metric logs: These logs provide information about the performance and health of a resource.
* Resource logs: These logs are specific to a resource type and provide resource-specific information.

Diagnostic logs can be collected using Azure Monitor, which is a service that enables you to collect, analyze, and act on data from a wide range of sources. Alternatively, you can forward these logs to your Log Analytics workspace. You can retrieve logs from AKS for Kubernetes components such as kube-apiserver, kube-controller-manager, kube-scheduler, kube-audit, and cluster-autoscaler.

Once the logs are visible in your AzureDiagnostics table, you can run detections. .

Here is a basic query that you can use in Azure Sentinel to look at NGINX logs for a specific pod:

KubernetesPodInventory

| where PodName contains “nginx”

| extend Pod = parse_json(Pod)

| extend Container = parse_json(Pod.spec.containers)

| extend Image = Container.image

| extend ImageName = extract(“(.+):.+”, 1, Image)

| project PodName, ImageName

This query will search the KubernetesPodInventory table for rows where the PodName field contains the string “nginx”, and it will extract the PodName and ImageName fields for those rows. The extend clauses are used to parse the JSON objects in the Pod and Container fields, and extract the image field from the Container object. The extract function is then used to extract the image name from the Image field.

Here is an example of a security-focused query that you can run on logs collected from Azure Kubernetes Service (AKS):

KubernetesAudit

| where Level == “Warning”

| where EventType == “Exec”

| extend User = parse_json(User)

| project TimeGenerated, User.username, Namespace, Resource, Action

This query will search the KubernetesAudit table for rows where the Level field is “Warning” and the EventType field is “Exec”. It will then extract the TimeGenerated, username, Namespace, Resource, and Action fields for those rows, and parse the User field into a JSON object so that the username field can be extracted.

This query will return a list of audit events that correspond to warning-level exec events, which could include things like attempts to execute a command in a container or access a shell in a pod. You can use this query to identify suspicious activity and investigate further. ConclusionIn conclusion, Azure Sentinel is a powerful tool for protecting Kubernetes deployments. Its advanced security analytics capabilities and integration with a wide range of data sources make it well-suited for detecting and responding to threats in Kubernetes environments. By collecting logs and other data from your Kubernetes cluster and using Azure Sentinel to m[...]

onitor and analyze that data, you can gain valuable insights into the operation of your cluster and identify potential security issues before they become a problem.

Additionally, the ability to create alerts and take automated actions based on the data in your logs can help you to respond to threats in a timely and effective manner, reducing the risk of a breach or other security incident.

hacking: security in practice
Hiding text in files

Awhile back I was looking at some malicious stuff that showed up on someone's server and one of the tricks they did was to hide a bunch of javascript in template files. If you catted the file or viewed it in nano you saw nothing. View it in vi and poof, bunch of malicious code.

Thought it was kind of cool but didn't take notes or keep samples. Year later I find a need for this for a project. Google searches were somewhat unhelpful since all manner of stupid stuff matches.

Anyone know what the method is called so I can do more research?

submitted by /u/FantasticThing359
[link] [comments]

hacking: security in practice
Is there phones who call without a sim card

So i am looking to find a device, that can call normally without a sim card, and that is also able to set custom caller id (so i can call as somebody else)

Btw i am not looking to do anything illegal or harmful with such a device, all i am asking for is what is such a device called, where can i buy one, and also if there is no such device whats the closest thing to it?

submitted by /u/PreciseInstance
[link] [comments]

Attacker Simulation and Vulnerability Management Programs
https://www.reddit.com/r/Pentesting/comments/10a77au/attacker_simulation_and_vulnerability_management/

<!-- SC_OFF -->I am struggling with implementing SafeBreach at my organization and I was hoping I could get some peer feed back on how they have implemented SafeBreach or other Attack/Adversary emulation tools within their organization. My primary question is how do you make use of your simulation results? It is hard to find value in these products when you are running the same tests every week with nearly the same results. It is pretty difficult to make impactful changes to the org's security tooling and posture to have any notable influence over the simulation results. For other SafeBreach customers - What simulations are you running and on what cadence? What has provided the most value to your org from this tool? <!-- SC_ON --> submitted by /u/cyopeng (https://www.reddit.com/user/cyopeng)
[link] (https://www.reddit.com/r/Pentesting/comments/10a77au/attacker_simulation_and_vulnerability_management/) [comments] (https://www.reddit.com/r/Pentesting/comments/10a77au/attacker_simulation_and_vulnerability_management/)

Hacking on Medium
HackTheBox writeup — Dancing

https://cdn-images-1.medium.com/max/704/1*hyI6K7RPIjUFa0cX9zA48Q.png
Let’s start with scanning the machine using nmap.

Continue reading on Medium »

Hacking on Medium
Home Grown Red Team: Installing NetHunter On A Nexus 5 (Like It’s 2013).

https://cdn-images-1.medium.com/max/600/1*i7L8nsLt3b7DKfX7aNfiIw.png
I already know what you’re thinking. What year is it? It’s 2023 and the price of a Raspberry Pi is $150 for a top tier model. A Raspberry…

Continue reading on Medium »

Hacking on Medium
Epoch — Try Hack Me

https://cdn-images-1.medium.com/max/1020/1*8iRkjC3cS8URy_Pbjgq3_Q.png
#epoch #linux #timestamp #commandinjection

Continue reading on Medium »

Hacking on Medium
El malware IcedID ataca de nuevo: Dominio de Active Directory comprometido en menos de 24 horas

https://cdn-images-1.medium.com/max/1541/0*GNWczCm291Ii0ZF_
Un reciente ataque de malware IcedID permitió al actor de amenazas comprometer el dominio de Active Directory de un objetivo sin nombre…

Continue reading on Medium »

Hacking on Medium
Quiet quitting helped me start my business, while making me an extra $1000 USD per month.

https://cdn-images-1.medium.com/max/2600/1*v8jgow9_poizZUNVsnh-0A.jpeg
With the right mindset quiet quitting can be the opportunity of your lifetime. It could be a risk free way to boost your income and…

Continue reading on Medium »

Hacking on Medium
Hacking an Original Gameboy to play better than new

https://cdn-images-1.medium.com/max/2509/1*JR_lBZIYQY95j7frRiKLQQ.png
The original Nintendo Gameboy was released in 1989 and went on to be one of highest-selling video game consoles of all time.

Continue reading on Medium »

Dark Reading: Attacks/Breaches
$20K Buys Insider Access to Telegram Servers, Dark Web Ad Claims

In the ad, cybercriminals are offering to sell employee-level access to Telegram, researchers warn.