THREAT OPS › Threat News › CiliumHound: Graphing Kubernetes Network Policies
CiliumHound: Graphing Kubernetes Network Policies
<p class="wp-block-paragraph"><em><strong>TLDR:</strong> <a href="https://github.com/Sw4mpf0x/CiliumHound">CiliumHound</a> is a BloodHound OpenGraph extension for auditing Cilium network policies. It ingests a folder of JSON or YAML policies and creates a searchable, Kubernetes namespace-scoped graph.</em></p>
<h2 class="wp-block-heading" id="h-introduction">Introduction</h2>
<p class="wp-bl
MITRE ATT&CK techniques
- CredentialsT1589.001
Indicators of compromise
- https://docs.cilium.io/en/stable/security/policy/layer3/url
- https://docs.cilium.io/en/stable/security/policy/layer4/url
- https://docs.cilium.io/en/stable/security/policy/layer7/url
- 100.64.0.0ipv4
- 10.1.1.1/32cidr
- 10.60.0.0/16cidr
- 169.254.169.254/32cidr
- 100.64.0.0/10cidr
- app.kubernetes.iodomain