AWS guardduty medium security documentation change
Summary
Removed documentation for two retired Kubernetes security findings and their remediation guidance
Security assessment
Eliminates documentation for PrivilegeEscalation:Kubernetes/PrivilegedContainer and Persistence:Kubernetes/ContainerWithSensitiveMount findings, indicating these security detections are no longer supported. This reflects product security changes.
Diff
diff --git a/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.md b/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.md index 58bafcd26..4f23095a4 100644 --- a//guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.md +++ b//guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.md @@ -7 +7 @@ -CredentialAccess:Kubernetes/MaliciousIPCallerCredentialAccess:Kubernetes/MaliciousIPCaller.CustomCredentialAccess:Kubernetes/SuccessfulAnonymousAccessCredentialAccess:Kubernetes/TorIPCallerDefenseEvasion:Kubernetes/MaliciousIPCallerDefenseEvasion:Kubernetes/MaliciousIPCaller.CustomDefenseEvasion:Kubernetes/SuccessfulAnonymousAccessDefenseEvasion:Kubernetes/TorIPCallerDiscovery:Kubernetes/MaliciousIPCallerDiscovery:Kubernetes/MaliciousIPCaller.CustomDiscovery:Kubernetes/SuccessfulAnonymousAccessDiscovery:Kubernetes/TorIPCallerExecution:Kubernetes/ExecInKubeSystemPodImpact:Kubernetes/MaliciousIPCallerImpact:Kubernetes/MaliciousIPCaller.CustomImpact:Kubernetes/SuccessfulAnonymousAccessImpact:Kubernetes/TorIPCallerPersistence:Kubernetes/ContainerWithSensitiveMountPersistence:Kubernetes/MaliciousIPCallerPersistence:Kubernetes/MaliciousIPCaller.CustomPersistence:Kubernetes/SuccessfulAnonymousAccessPersistence:Kubernetes/TorIPCallerPolicy:Kubernetes/AdminAccessToDefaultServiceAccountPolicy:Kubernetes/AnonymousAccessGrantedPolicy:Kubernetes/ExposedDashboardPolicy:Kubernetes/KubeflowDashboardExposedPrivilegeEscalation:Kubernetes/PrivilegedContainerCredentialAccess:Kubernetes/AnomalousBehavior.SecretsAccessedPrivilegeEscalation:Kubernetes/AnomalousBehavior.RoleBindingCreatedExecution:Kubernetes/AnomalousBehavior.ExecInPodPrivilegeEscalation:Kubernetes/AnomalousBehavior.WorkloadDeployed!PrivilegedContainerPersistence:Kubernetes/AnomalousBehavior.WorkloadDeployed!ContainerWithSensitiveMountExecution:Kubernetes/AnomalousBehavior.WorkloadDeployedPrivilegeEscalation:Kubernetes/AnomalousBehavior.RoleCreatedDiscovery:Kubernetes/AnomalousBehavior.PermissionChecked +CredentialAccess:Kubernetes/MaliciousIPCallerCredentialAccess:Kubernetes/MaliciousIPCaller.CustomCredentialAccess:Kubernetes/SuccessfulAnonymousAccessCredentialAccess:Kubernetes/TorIPCallerDefenseEvasion:Kubernetes/MaliciousIPCallerDefenseEvasion:Kubernetes/MaliciousIPCaller.CustomDefenseEvasion:Kubernetes/SuccessfulAnonymousAccessDefenseEvasion:Kubernetes/TorIPCallerDiscovery:Kubernetes/MaliciousIPCallerDiscovery:Kubernetes/MaliciousIPCaller.CustomDiscovery:Kubernetes/SuccessfulAnonymousAccessDiscovery:Kubernetes/TorIPCallerExecution:Kubernetes/ExecInKubeSystemPodImpact:Kubernetes/MaliciousIPCallerImpact:Kubernetes/MaliciousIPCaller.CustomImpact:Kubernetes/SuccessfulAnonymousAccessImpact:Kubernetes/TorIPCallerPersistence:Kubernetes/MaliciousIPCallerPersistence:Kubernetes/MaliciousIPCaller.CustomPersistence:Kubernetes/SuccessfulAnonymousAccessPersistence:Kubernetes/TorIPCallerPolicy:Kubernetes/AdminAccessToDefaultServiceAccountPolicy:Kubernetes/AnonymousAccessGrantedPolicy:Kubernetes/ExposedDashboardPolicy:Kubernetes/KubeflowDashboardExposedCredentialAccess:Kubernetes/AnomalousBehavior.SecretsAccessedPrivilegeEscalation:Kubernetes/AnomalousBehavior.RoleBindingCreatedExecution:Kubernetes/AnomalousBehavior.ExecInPodPrivilegeEscalation:Kubernetes/AnomalousBehavior.WorkloadDeployed!PrivilegedContainerPersistence:Kubernetes/AnomalousBehavior.WorkloadDeployed!ContainerWithSensitiveMountExecution:Kubernetes/AnomalousBehavior.WorkloadDeployedPrivilegeEscalation:Kubernetes/AnomalousBehavior.RoleCreatedDiscovery:Kubernetes/AnomalousBehavior.PermissionChecked @@ -55,2 +54,0 @@ If the activity because of which these findings get generated is expected, consi - * Persistence:Kubernetes/ContainerWithSensitiveMount - @@ -73,2 +70,0 @@ If the activity because of which these findings get generated is expected, consi - * PrivilegeEscalation:Kubernetes/PrivilegedContainer - @@ -403,19 +398,0 @@ If the user reported in the finding under the `KubernetesUserDetails` section is -## Persistence:Kubernetes/ContainerWithSensitiveMount - -### A container was launched with a sensitive external host path mounted inside. - -**Default severity: Medium** - - * **Feature:** EKS audit logs - - - - -This finding informs you that a container was launched with a configuration that included a sensitive host path with write access in the `volumeMounts` section. This makes the sensitive host path accessible and writable from inside the container. This technique is commonly used by adversaries to gain access to the host's filesystem. - -**Remediation recommendations:** - -If this container launch is unexpected, the credentials of the user identity used to launch the container may be compromised. Revoke access of the user and reverse any changes made by an adversary to your cluster. For more information, see [Remediating EKS Protection findings](./guardduty-remediate-kubernetes.html). - -If this container launch is expected, it's recommended that you use a suppression rule consisting of a filter criteria based on the `resource.KubernetesDetails.KubernetesWorkloadDetails.containers.imagePrefix` field. In the filter criteria the `imagePrefix` field should be same as the `imagePrefix` specified in the finding. To learn more about creating suppression rules see [Suppression rules](https://docs.aws.amazon.com/guardduty/latest/ug/findings_suppression-rule). - @@ -564,17 +540,0 @@ For more information, see [Remediating EKS Protection findings](./guardduty-reme -## PrivilegeEscalation:Kubernetes/PrivilegedContainer - -### A privileged container with root level access was launched on your Kubernetes cluster. - -**Default severity: Medium** - - * **Feature:** EKS audit logs - - - - -This finding informs you that a privileged container was launched on your Kubernetes cluster using an image has never before been used to launch privileged containers in your cluster. A privileged container has root level access to the host. Adversaries can launch privileged containers as a privilege escalation tactic to gain access to and then compromise the host. - -**Remediation recommendations:** - -If this container launch is unexpected, the credentials of the user identity used to launch the container may be compromised. Revoke access of the user and reverse any changes made by an adversary to your cluster. For more information, see [Remediating EKS Protection findings](./guardduty-remediate-kubernetes.html). -