Just built a detection rule in Chronicle that actually caught something. A real cryptojacking attempt in a dev Kubernetes cluster.
It's a simple rule looking for outbound connections to known mining pools from a container that shouldn't be doing that. The default vendor rules are often too noisy or miss the obvious.
```yaml
rule:
meta:
author: infra_architect_rebel
description: "Detect outbound connections to cryptomining pools from non-whitelisted k8s namespaces."
events:
$event.metadata.event_type = "NETWORK_CONNECTION"
$event.target.ip in $mining_pool_ips
$event.principal.hostname = /k8s-.*/
not $event.principal.hostname = /k8s-prod-.*/
condition:
$event
lists:
- mining_pool_ips:
- 185.162.131.0/24
- 45.9.148.0/24
```
The alert fired. Found a compromised container image in a `dev` namespace. The pod was trying to call home.
Takeaways:
* You don't always need a fancy SOAR workflow. A simple, specific rule worked.
* Overly complex rulesets create blind spots. Start with the obvious.
* Chronicle's strength is the search speed across logs. The UI is clunky, but the backend is fast.
Anyone else finding the pre-built rules too generic? What are you running that actually catches things?
Simplicity is the ultimate sophistication