splApache-2.0from splunk/security_content

Cisco Isovalent - Curl Execution With Insecure Flags

The following analytic detects the execution of curl commands with insecure flags within the Cisco Isovalent environment. It identifies this activity by monitoring process execution logs for curl commands that use the -k or --insecure flags. This behavior is significant for a SOC as it could allow an attacker to bypass SSL/TLS verification, potentially exposing the Kubernetes infrastructure to man-in-the-middle attacks. If confirmed malicious, this activity could lead to data interception, service disruptions, or unauthorized access to sensitive information.

Quality

FP risk

—

Forks

Views

Rule sourcedetections/endpoint/cisco_isovalent___curl_execution_with_insecure_flags.yml

`cisco_isovalent_process_exec`  process_name="curl"
| regex process="(?i)(?<!\w)-(?:[a-z]*k[a-z]*|-(insecure|proxy-insecure|doh-insecure))"
| stats count min(_time) as firstTime max(_time) as lastTime values(process) as process
    by cluster_name pod_name parent_process_name process_name process_exec process_id node_name
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `cisco_isovalent___curl_execution_with_insecure_flags_filter`