Cisco Isovalent - new detections batch 1 #3706

patel-bhavin · 2025-10-02T00:04:52Z

New Analytic Story - [1]

Cisco Isovalent Suspicious Activity

New Analytics - [10]

Cisco Isovalent - Access To Cloud Metadata Service
Cisco Isovalent - Cron Job Creation
Cisco Isovalent - Curl Execution With Insecure Flags
Cisco Isovalent - Kprobe Spike
Cisco Isovalent - Late Process Execution
Cisco Isovalent - Nsenter Usage in Kubernetes Pod
Cisco Isovalent - Pods Running Offensive Tools
Cisco Isovalent - Potential Escape to Host
Cisco Isovalent - Shell Execution
Cisco Isovalent - Suspicious Image Use

Updated Analytics - [6]

Macros Added - [3]

cisco_isovalent
cisco_isovalent_allowed_images
cisco_isovalent_process_connect.yml
cisco_isovalent_process_exec
excluded_cloud_binaries.yml
linux_offsec_tool_processes.yml

Data Sources Added [3]

Cisco Isovalent Process Connect
Cisco Isovalent Process Exec
Cisco Isovalent Process Kprobe

nasbench

@patel-bhavin I think you should move the analytics to the endpoint folder. Since this telemetry stems from an endpoint.

detections/cloud/cisco_isovalent___potential_escape_to_host.yml

contentctl.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

ljstella · 2025-11-19T23:25:40Z

@patel-bhavin I think you should move the analytics to the endpoint folder. Since this telemetry stems from an endpoint.

I will say then that if we're moving things out of cloud/, it's probably worth evaluating the use of pod_name and cluster_name in the stats commands, as well as null checks on them, as most of those can likely be applicable to non-k8s use cases as well.

edit: Part of why it made sense to keep them in cloud was because they specifically required the use of k8s, and all the k8s detections are in cloud/

patel-bhavin · 2025-11-20T20:44:08Z

Will ship these in the endpoint directory for now as these logs are originating from an endpoint and these isovalent logs are not like the standard type of cloud/ logs that we have. Likely considering moving them into a containers directory in the future!

patel-bhavin · 2025-12-02T01:03:30Z

Holding off releasing this content until the CSC TA is fixed : targetting CSC TA 3.5.2

patel-bhavin · 2025-12-15T17:53:18Z

All detections passed using a test build provided by Pavlo : CiscoSecurityCloud-develop_2025-12-15_14-09.tar.gz

nasbench

One final review before merge.

nasbench · 2025-12-19T23:57:19Z

detections/endpoint/cisco_isovalent___suspicious_image_use.yml

@@ -0,0 +1,79 @@
+name: Cisco Isovalent - Suspicious Image Use


Perhaps we should try and avoid the use of the word suspicious here. I like the word you used Non Allowlisted so let's use that. That way we can create a better picture for the end-user.

Suggested change

name: Cisco Isovalent - Suspicious Image Use

name: Cisco Isovalent - Non Allowlisted Image Use

nasbench · 2025-12-19T23:58:01Z

detections/endpoint/cisco_isovalent___suspicious_image_use.yml

+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+rba:
+  message: Suspicious (non‑allowlisted) image $pod_image_name$ used by pod $pod_name$ in namespace $Namespace$ in the cluster $cluster_name$


Suggested change

message: Suspicious (non‑allowlisted) image $pod_image_name$ used by pod $pod_name$ in namespace $Namespace$ in the cluster $cluster_name$

message: Non Allowlisted image $pod_image_name$ used by pod $pod_name$ in namespace $Namespace$ in the cluster $cluster_name$

nasbench · 2025-12-19T23:58:32Z

detections/endpoint/cisco_isovalent___suspicious_image_use.yml

+  - field: process_name
+    type: process_name


Maybe we could add pod_image_name here?

nasbench · 2025-12-20T00:01:13Z

detections/endpoint/cisco_isovalent___shell_execution.yml

+status: production
+description: The following analytic detects the execution of a shell inside a container namespace within the Cisco Isovalent environment. It identifies this activity by monitoring process execution logs for the execution of a shell (sh or bash) inside a container namespace. This behavior is significant for a SOC as it could allow an attacker to gain shell access to the container, potentially leading to further compromise of the Kubernetes cluster. If confirmed malicious, this activity could lead to data theft, service disruption, privilege escalation, lateral movement, and further attacks, severely compromising the cluster's security and integrity.
+search: |
+  `cisco_isovalent_process_exec` process_name IN ("sh", "bash", "pwsh", "zsh") 


I assume pwsh is a typo here (because its refereeing to powershell.

Since we cannot use the macro linux_shells directly. Let's at least use the same list

Suggested change

`cisco_isovalent_process_exec` process_name IN ("sh", "bash", "pwsh", "zsh")

`cisco_isovalent_process_exec` process_name IN ("sh", "ksh", "zsh", "bash", "dash", "rbash", "fish", "csh", "tcsh", "ion", "eshell")

nasbench · 2025-12-20T00:02:10Z

detections/endpoint/cisco_isovalent___shell_execution.yml

+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+rba:
+  message: A shell execution has been detected by user on container pod namespace $node_name$


Suggested change

message: A shell execution has been detected by user on container pod namespace $node_name$

message: The shell $process_name$ was executed by $user$ on container pod namespace $node_name$

nasbench · 2025-12-20T00:04:15Z

detections/endpoint/cisco_isovalent___potential_escape_to_host.yml

+      process_name IN ("nsenter","mount","ps","ls")
+      OR process="*nsenter*" OR process="*mount*" OR process="*ps aux*" OR process="*ps -ef*"


This feels better to read.

I also wanted to point out that by saying process_name == ps it actually include all CLI options like ps -ef or ps aux so we actually do not need them, but I will leave them just in case there are is one but no the other.

Suggested change

process_name IN ("nsenter","mount","ps","ls")

OR process="*nsenter*" OR process="*mount*" OR process="*ps aux*" OR process="*ps -ef*"

process_name IN ("nsenter","mount","ps","ls")

OR

process IN ("*nsenter*", "*mount*", "*ps aux*", "*ps -ef*")

nasbench · 2025-12-20T00:05:11Z

detections/endpoint/cisco_isovalent___potential_escape_to_host.yml

+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+rba:
+  message: Escape-to-host attempt detected in pod $pod_name$ on cluster $cluster_name$


Maybe we can add the executed command in the message for clarity and ease of triage.

nasbench · 2025-12-20T00:07:04Z

detections/endpoint/cisco_isovalent___kprobe_spike.yml

+  More than 10 kprobe events within 5 minutes may indicate suspicious activity, such as an attacker probing the kernel through repeated system calls (e.g., nsenter, mount, sethostname). 
+  Such abnormal volume and frequency of kprobe usage within application pods or on nodes can signal container escape attempts or low-level tampering with the host, thereby representing a potential security threat.
+search: |
+  `cisco_isovalent` "process_kprobe.action"!=""


Suggested change

`cisco_isovalent` "process_kprobe.action"!=""

`cisco_isovalent` process_kprobe.action!=""

nasbench · 2025-12-20T00:09:43Z

macros/excluded_cloud_binaries.yml

@@ -0,0 +1,3 @@
+definition: search binary != "/app/aws-vpc-cni" AND binary != "/usr/bin/amazon-ssm-agent" AND binary != "/usr/bin/ssm-agent-worker"


To catch /usr/bin and /bin

Also does /app/aws-vpc-cni need a wildcard at the start?

Suggested change

definition: search binary != "/app/aws-vpc-cni" AND binary != "/usr/bin/amazon-ssm-agent" AND binary != "/usr/bin/ssm-agent-worker"

definition: search binary != "/app/aws-vpc-cni" AND binary != "*/bin/amazon-ssm-agent" AND binary != "*/bin/ssm-agent-worker"

nasbench · 2025-12-20T00:10:02Z

detections/endpoint/cisco_isovalent___access_to_cloud_metadata_service.yml

+    sourcetype: cisco:isovalent:processConnect
+
+


Suggested change

sourcetype: cisco:isovalent:processConnect

sourcetype: cisco:isovalent:processConnect

patel-bhavin added 27 commits August 14, 2025 14:27

adding 1 detection

9c53da8

one more

3fdd953

not sure

36aac51

adding draft detections

21b17fd

Merge branch 'develop' into isovalent_batch_1

40c9732

stash a commit

4f78689

updating sourcetype and fields

c9e8628

updating detections

2a8d3e4

textual updates

b54a8cc

new detection for sus images

fd21a77

udpating fields

fd5f7c2

adding new search

ed3bc02

Merge branch 'develop' into isovalent_batch_1

dff1a2c

testing TA

d602c7e

space

576fac3

fixing sourcetype

f21f9e4

updating detection and dataset

a50280d

updates to all files

b6058aa

updating isovalent detections

f800a3b

updating dataset

be1c385

Merge branch 'develop' into isovalent_batch_1

f692117

updating two detections

1bd337d

yaml fixes

e8d6292

fixing mitre

4fbadb3

added dataset for curl

64dd230

add new detection

03ff337

new detection

a181580

github-actions bot added Detections Stories Macros labels Oct 2, 2025

update based on Lou feedback

d0c6910

nasbench reviewed Nov 19, 2025

View reviewed changes

detections/cloud/cisco_isovalent___potential_escape_to_host.yml Outdated Show resolved Hide resolved

contentctl.yml Outdated Show resolved Hide resolved

Apply suggestion from @nasbench

c7fc9e8

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

patel-bhavin added 2 commits November 20, 2025 09:49

moving to endpoint

bec19b5

atomics

50fce42

nasbench previously approved these changes Nov 20, 2025

View reviewed changes

patel-bhavin and others added 4 commits November 20, 2025 16:07

Merge branch 'develop' into isovalent_batch_1

035c5a1

Merge branch 'develop' into isovalent_batch_1

b50fe13

Merge branch 'develop' into isovalent_batch_1

c4089da

updating CSC TA to 3.5.1

f028e0b

patel-bhavin dismissed nasbench’s stale review via f028e0b November 25, 2025 22:35

Merge branch 'develop' into isovalent_batch_1

9fe41fa

patel-bhavin removed this from the v5.19.0 milestone Dec 2, 2025

patel-bhavin added 3 commits December 2, 2025 14:51

Merge branch 'develop' into isovalent_batch_1

9ae4d7c

Merge branch 'develop' into isovalent_batch_1

7c02c55

Merge branch 'develop' into isovalent_batch_1

283549f

patel-bhavin and others added 3 commits December 16, 2025 18:43

adding contentctl

f595550

Merge branch 'develop' into isovalent_batch_1

a16e915

revert test app

67d6b83

nasbench added this to the v5.20.0 milestone Dec 18, 2025

patel-bhavin and others added 4 commits December 19, 2025 13:03

updating ctl

e5aaca4

Merge branch 'develop' into isovalent_batch_1

b560c21

Merge branch 'develop' into isovalent_batch_1

fbc120a

Merge branch 'develop' into isovalent_batch_1

dd7117d

nasbench self-requested a review December 19, 2025 16:10

nasbench reviewed Dec 20, 2025

View reviewed changes

		@@ -0,0 +1,79 @@
		name: Cisco Isovalent - Suspicious Image Use

	name: Cisco Isovalent - Suspicious Image Use
	name: Cisco Isovalent - Non Allowlisted Image Use

	message: Suspicious (non‑allowlisted) image $pod_image_name$ used by pod $pod_name$ in namespace $Namespace$ in the cluster $cluster_name$
	message: Non Allowlisted image $pod_image_name$ used by pod $pod_name$ in namespace $Namespace$ in the cluster $cluster_name$

	`cisco_isovalent_process_exec` process_name IN ("sh", "bash", "pwsh", "zsh")
	`cisco_isovalent_process_exec` process_name IN ("sh", "ksh", "zsh", "bash", "dash", "rbash", "fish", "csh", "tcsh", "ion", "eshell")

	message: A shell execution has been detected by user on container pod namespace $node_name$
	message: The shell $process_name$ was executed by $user$ on container pod namespace $node_name$

		process_name IN ("nsenter","mount","ps","ls")
		OR process="nsenter" OR process="mount" OR process="ps aux" OR process="ps -ef"

	`cisco_isovalent` "process_kprobe.action"!=""
	`cisco_isovalent` process_kprobe.action!=""

		@@ -0,0 +1,3 @@
		definition: search binary != "/app/aws-vpc-cni" AND binary != "/usr/bin/amazon-ssm-agent" AND binary != "/usr/bin/ssm-agent-worker"

	sourcetype: cisco:isovalent:processConnect
	sourcetype: cisco:isovalent:processConnect

Cisco Isovalent - new detections batch 1 #3706

Are you sure you want to change the base?

Cisco Isovalent - new detections batch 1 #3706

Uh oh!

Conversation

patel-bhavin commented Oct 2, 2025 • edited by nasbench Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

New Analytic Story - [1]

New Analytics - [10]

Updated Analytics - [6]

Macros Added - [3]

Data Sources Added [3]

Uh oh!

nasbench left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

ljstella commented Nov 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

patel-bhavin commented Nov 20, 2025

Uh oh!

patel-bhavin commented Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

patel-bhavin commented Dec 15, 2025

Uh oh!

nasbench left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

patel-bhavin commented Oct 2, 2025 •

edited by nasbench

Loading

ljstella commented Nov 19, 2025 •

edited

Loading

patel-bhavin commented Dec 2, 2025 •

edited

Loading