THREAT-413 - Tune EKS Anonymous API Access Detection Rule (#1405)

[arielkr256]

Tuned version of #1405

Background

This change introduces a new detection rule for identifying anonymous API access to the Kubernetes API server in Amazon EKS clusters. Anonymous access should be disabled in production environments to prevent unauthorized access, as it poses a potential security risk. Detecting anonymous requests helps ensure that EKS clusters are properly configured for secure API usage.

Changes

• Added a new detection rule Amazon.EKS.AnonymousAPIAccess to monitor and detect anonymous API requests to the Kubernetes API server.
• Included a YAML configuration for the rule with severity set to medium and associated MITRE ATT&CK references.
• Provided test cases to validate both anonymous and non-anonymous API requests.
• Documented remediation steps and runbook reference to disable anonymous access in the Kubernetes configuration.

Testing

• Ran panther_analysis_tool to validate the new detection rule and test cases.
• Verified that the test cases pass for both anonymous and non-anonymous API access scenarios.
• Ensured that the rule raises an alert for anonymous API requests and remains silent for authenticated API requests.
• Tuned based on log data from lab environment

[arielkr256]

@bcpenta we noticed some noise with this rule when we deployed it to our lab environment. Please take a look at the tuning changes and let us know if you have any questions!

[ben-githubs]

I'd like to hold off on merging until we get those sample logs where objectRef is missing - I suspect the tuning improvements will probably exclude those events, but would like to confirm before we merge this!

[arielkr256]

Old title: Anonymous API access detected on Kubernetes API server from [10.0.21.88] to [<NO_OBJECT_RESOURCE>] in namespace [<NO_OBJECT_NAMESPACE>] on [Threat Research - EKS K8S GOAT]

New title: Anonymous API access detected on Kubernetes API server from [10.0.21.88] to [/healthz?exclude=kms-provider-0&exclude=kms-provider-1&exclude=kms-providers] on [Threat Research - EKS K8S GOAT]