AWS guardduty medium security documentation change
Summary
Added documentation for two new retired Kubernetes finding types: PrivilegeEscalation:Kubernetes/PrivilegedContainer and Persistence:Kubernetes/ContainerWithSensitiveMount. Includes descriptions, severity levels, and remediation steps.
Security assessment
Documents security vulnerabilities in Kubernetes environments where privileged containers can lead to root access (privilege escalation) and sensitive host path mounts can enable host filesystem access (persistence technique). Includes explicit remediation guidance for compromised credentials.
Diff
diff --git a/guardduty/latest/ug/guardduty_finding-types-retired.md b/guardduty/latest/ug/guardduty_finding-types-retired.md index 3dc0da79b..93ddcc7ce 100644 --- a//guardduty/latest/ug/guardduty_finding-types-retired.md +++ b//guardduty/latest/ug/guardduty_finding-types-retired.md @@ -7 +7 @@ -Exfiltration:S3/ObjectRead.UnusualImpact:S3/PermissionsModification.UnusualImpact:S3/ObjectDelete.UnusualDiscovery:S3/BucketEnumeration.UnusualPersistence:IAMUser/NetworkPermissionsPersistence:IAMUser/ResourcePermissionsPersistence:IAMUser/UserPermissionsPrivilegeEscalation:IAMUser/AdministrativePermissionsRecon:IAMUser/NetworkPermissionsRecon:IAMUser/ResourcePermissionsRecon:IAMUser/UserPermissionsResourceConsumption:IAMUser/ComputeResourcesStealth:IAMUser/LoggingConfigurationModifiedUnauthorizedAccess:IAMUser/ConsoleLoginUnauthorizedAccess:EC2/TorIPCallerBackdoor:EC2/XORDDOSBehavior:IAMUser/InstanceLaunchUnusualCryptoCurrency:EC2/BitcoinTool.AUnauthorizedAccess:IAMUser/UnusualASNCaller +PrivilegeEscalation:Kubernetes/PrivilegedContainerPersistence:Kubernetes/ContainerWithSensitiveMountExfiltration:S3/ObjectRead.UnusualImpact:S3/PermissionsModification.UnusualImpact:S3/ObjectDelete.UnusualDiscovery:S3/BucketEnumeration.UnusualPersistence:IAMUser/NetworkPermissionsPersistence:IAMUser/ResourcePermissionsPersistence:IAMUser/UserPermissionsPrivilegeEscalation:IAMUser/AdministrativePermissionsRecon:IAMUser/NetworkPermissionsRecon:IAMUser/ResourcePermissionsRecon:IAMUser/UserPermissionsResourceConsumption:IAMUser/ComputeResourcesStealth:IAMUser/LoggingConfigurationModifiedUnauthorizedAccess:IAMUser/ConsoleLoginUnauthorizedAccess:EC2/TorIPCallerBackdoor:EC2/XORDDOSBehavior:IAMUser/InstanceLaunchUnusualCryptoCurrency:EC2/BitcoinTool.AUnauthorizedAccess:IAMUser/UnusualASNCaller @@ -20,0 +21,4 @@ You can't reactivate retired GuardDuty finding types. + * PrivilegeEscalation:Kubernetes/PrivilegedContainer + + * Persistence:Kubernetes/ContainerWithSensitiveMount + @@ -61,0 +66,36 @@ You can't reactivate retired GuardDuty finding types. +## PrivilegeEscalation:Kubernetes/PrivilegedContainer + +### A privileged container with root level access was launched on your Kubernetes cluster. + +**Default severity: Medium** + + * **Feature:** EKS audit logs + + + + +This finding informs you that a privileged container was launched on your Kubernetes cluster using an image has never before been used to launch privileged containers in your cluster. A privileged container has root level access to the host. Adversaries can launch privileged containers as a privilege escalation tactic to gain access to and then compromise the host. + +**Remediation recommendations:** + +If this container launch is unexpected, the credentials of the user identity used to launch the container may be compromised. Revoke access of the user and reverse any changes made by an adversary to your cluster. For more information, see [Remediating EKS Protection findings](./guardduty-remediate-kubernetes.html). + +## Persistence:Kubernetes/ContainerWithSensitiveMount + +### A container was launched with a sensitive external host path mounted inside. + +**Default severity: Medium** + + * **Feature:** EKS audit logs + + + + +This finding informs you that a container was launched with a configuration that included a sensitive host path with write access in the `volumeMounts` section. This makes the sensitive host path accessible and writable from inside the container. This technique is commonly used by adversaries to gain access to the host's filesystem. + +**Remediation recommendations:** + +If this container launch is unexpected, the credentials of the user identity used to launch the container may be compromised. Revoke access of the user and reverse any changes made by an adversary to your cluster. For more information, see [Remediating EKS Protection findings](./guardduty-remediate-kubernetes.html). + +If this container launch is expected, it's recommended that you use a suppression rule consisting of a filter criteria based on the `resource.KubernetesDetails.KubernetesWorkloadDetails.containers.imagePrefix` field. In the filter criteria the `imagePrefix` field should be same as the `imagePrefix` specified in the finding. To learn more about creating suppression rules see [Suppression rules](https://docs.aws.amazon.com/guardduty/latest/ug/findings_suppression-rule). +