We’ll deploy: Azure Kubernetes Service (AKS) Azure Application Gateway (WAF v2) Azure Application Gateway Ingress Controller (AGIC) A simple NGINX test app 🔷 Prerequisites Make sure: az version kubectl version --cl…

Sichere Programmierung dev.to 01.03.2026, 08:01 Uhr 3 Min. Lesezeit Cloud & IT-Enterprise

↗ Quelle (dev.to)

Reagiere als Erste:r — dein Feedback zählt!

We’ll deploy:

Azure Kubernetes Service (AKS)

Azure Application Gateway (WAF v2)

Azure Application Gateway Ingress Controller (AGIC)

A simple NGINX test app

🔷 Prerequisites

Make sure:

az version

kubectl version --client

az login

Set variables:

RG=rg-aks-agic-demo

LOCATION=eastus2

AKS_NAME=aks-agic-demo

APPGW_NAME=appgw-agic-demo

VNET_NAME=vnet-agic-demo

AKS_SUBNET=aks-subnet

APPGW_SUBNET=appgw-subnet

🟢 Step 1 — Create Resource Group

az group create \

  --name $RG \

  --location $LOCATION

🟢 Step 2 — Create VNet with 2 Subnets

⚠️ Application Gateway must be in a dedicated subnet.

az network vnet create \

  --resource-group $RG \

  --name $VNET_NAME \

  --address-prefix 10.0.0.0/8 \

  --subnet-name $AKS_SUBNET \

  --subnet-prefix 10.240.0.0/16

Create App Gateway subnet:

az network vnet subnet create \

  --resource-group $RG \

  --vnet-name $VNET_NAME \

  --name $APPGW_SUBNET \

  --address-prefix 10.241.0.0/16

🟢 Step 3 — Create Public IP for App Gateway

az network public-ip create \

  --resource-group $RG \

  --name appgw-pip \

  --sku Standard \

  --allocation-method Static

🟢 Step 4 — Create Application Gateway (WAF v2)

az network application-gateway create \

  --name $APPGW_NAME \

  --resource-group $RG \

  --location $LOCATION \

  --sku Standard_v2 \

  --capacity 2 \

  --vnet-name $VNET_NAME \

  --subnet appgw-subnet \

  --public-ip-address appgw-pip \

  --priority 100

🟢 Step 5 — Get Subnet ID for AKS

AKS_SUBNET_ID=$(az network vnet subnet show \

  --resource-group $RG \

  --vnet-name $VNET_NAME \

  --name $AKS_SUBNET \

  --query id -o tsv)

🟢 Step 6 — Create AKS with AGIC Enabled

We attach existing Application Gateway.

APPGW_ID=$(az network application-gateway show \

  --name $APPGW_NAME \

  --resource-group $RG \

  --query id -o tsv)

Now create AKS:

az aks create \

  --resource-group $RG \

  --name $AKS_NAME \

  --network-plugin azure \

  --vnet-subnet-id $AKS_SUBNET_ID \

  --enable-addons ingress-appgw \

  --appgw-id $APPGW_ID \

  --node-count 2 \

  --generate-ssh-keys

This automatically deploys AGIC inside AKS.

🟢 Step 7 — Get AKS Credentials

az aks get-credentials \

  --resource-group $RG \

  --name $AKS_NAME

Verify:

kubectl get pods -n kube-system

You should see AGIC pod running.

🟢 Step 8 — Deploy Demo Application

kubectl create deployment nginx --image=nginx

kubectl expose deployment nginx --port 80

Verify:

kubectl get svc

🟢 Step 9 — Create Ingress Resource

Create file: ingress.yaml

apiVersion: networking.k8s.io/v1

kind: Ingress

metadata:

  name: nginx-ingress

  annotations:

    kubernetes.io/ingress.class: azure/application-gateway

spec:

  rules:

  - http:

      paths:

      - path: /

        pathType: Prefix

        backend:

          service:

            name: nginx

            port:

              number: 80

Apply:

kubectl apply -f ingress.yaml

🟢 Step 10 — Get Public IP

az network public-ip show \

  --resource-group $RG \

  --name appgw-pip \

  --query ipAddress \

  --output tsv

Wait 2–3 minutes for AGIC to sync.

Open in browser:

http://<PUBLIC-IP>

You should see:

Welcome to nginx!

🔷 What Just Happened (Enterprise Flow)

Internet

   ↓

Application Gateway

   ↓

AGIC watches Ingress

   ↓

Routes to AKS Service

   ↓

Pod

Traffic never hits AKS directly.

Application Gateway filters it first.

🔷 Verify AGIC Is Syncing

Check logs:

kubectl logs -n kube-system \

  deploy/ingress-appgw-deployment

You should see configuration updates. (*)

(*) If have error like

E0301 06:36:34.657523       1 client.go:191] Code="ErrorApplicationGatewayForbidden"

See https://dev.to/pilgrim2go/troubleshooting-azure-application-gateway-ingress-controller-403-error-fhc

🧹 Cleanup

az group delete --name $RG --yes --no-wait

🎯 You Now Have

✅ Layer 7 routing outside cluster

✅ AKS private nodes

✅ Enterprise ingress pattern

IoC Intelligence (1 Indikatoren)

dev[.]to

CTI Threat Relationship Graph2 Knoten / 1 Relationen

CVE / Incident Software MITRE ATT&CK CWE Weakness IoC

IR-PLAYBOOK-RCEHIGH

Schritte anzeigen

SOC Incident Playbook: Remote Code Execution (RCE) Defense

WAF MitigationSofort

Virtuelles Patchen am Reverse Proxy / WAF für gefährdete URL-Pfade und Payloads aktivieren.

SecRule REQUEST_URI "@rx ..." "id:1001,phase:1,deny,status:403"

Web Shell ScanSofort

Web-Root auf neu angelegte Scripts, anomal modifizierte Dateien und Persistence scannen.

find /var/www -type f -name "*.php" -mmin -120

Outbound FilteringSofort

Ausgehenden Datenverkehr (Reverse Shells zu unbekannten IPs/Ports) blockieren.

ss -tunp | grep -E ":(4444|1337|8080|9001)"

Vendor Patching

Hersteller-Update in Staging validieren und schnellstmöglich in Produktion ausrollen.

apt update && apt --only-upgrade install <pkg>

1-Click Detection Engineering: Multi-Dialect SIEM Rules5 Formate

Regeln anzeigen

Syntax validiert (0 Fehler)

title: Detect Exploitation - Expose Kube Service Using Azure Application Gateway + AGIC
id: b14b6265-70db-4735-b0e6-bb97be0bc222
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-25
logsource:
  category: network_connection
  product: any
detection:
  selection:
      DestinationHostname:
        - 'dev.to'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access

Syntax validiert (0 Fehler)

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-25"
        description = "YARA Signature for "
    strings:
        $str = "Expose Kube Service Using Azur" ascii wide
    condition:
        any of them
}

Syntax validiert (0 Fehler)

index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
(dest_host="dev.to")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

Syntax validiert (0 Fehler)

destination.domain: ("dev.to") and event.category: "network"

Syntax validiert (0 Fehler)

CommonSecurityLog
| where DestinationHostName in ("dev.to")
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

🎯

MITRE ATT&CK Matrix Navigator 14 Taktiken

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

💡 Tipp: Klicken Sie auf eine TTP, um Gegenmaßnahmen und SIEM-Erkennungsregeln anzuzeigen.Enterprise Matrix v14.1

🚀 Auf tsecurity.de entdecken

◀ VORHERIGER BEITRAG 1 Min

Sparkassen-Kunden müssen jetzt reagieren: So können Sie Geld zurückbekommen

IT Nachrichten

NÄCHSTER BEITRAG 1 Min

Mehr Ordnung im Alltag: Amazon verkauft Etikettendrucker mit Bluetooth zum Sparpreis

IT NachrichtenWeiterlesen ▶

Blättern: Pfeiltasten [ ← ] [ → ] · Tasten j / k · mobil: Wischen

Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich Expose Kube Service Using Azure Applicat.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen

1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.

🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC

Schnell-Prompts für Analysten

⚠️ DEFANGED SANDBOX VIEW (tsecurity.de): Alle Netzwerkindikatoren und URLs wurden neutralisiert (2 Indikatoren entschärft). Nur zur defensiven Analyse!

Format: python

#!/usr/bin/env python3
# Exploit Title: PoC for Target
import socket, sys
target = '192[.]168[.]1[.]10'
url = 'hxxp://target[.]local/vuln'
s = socket.socket()
s.connect((target, 80))
s.send(b'GET / HTTP/1.1\r\nHost: target.local\r\n\r\n')