cscli scenarios install crowdsecurity/k8s-audit-service-account-access-deniedDetects service accounts making forbidden requests to the K8S API.
Only attempts done on resources that are logged at least at the Metadata level will be recorded.
No decision will be taken based on this scenario, it is only intended for notification purposes.
1type: trigger2name: crowdsecurity/k8s-audit-service-account-access-denied3description: "Detect unauthorized requests from service accounts"4filter: |5 evt.Meta.log_type == 'k8s-audit' &&6 evt.Meta.user startsWith "system:serviceaccount:" &&7 (8 (evt.Meta.datasource_type == "k8s-audit" && evt.Unmarshaled.k8s_audit.Annotations["authorization.k8s.io/decision"] == "forbid")9 ||10 (evt.Meta.datasource_type != "k8s-audit" && evt.Unmarshaled.k8s_audit.annotations["authorization.k8s.io/decision"] == "forbid")11 )12labels:13 notification: true14 classification:15 - attack.T107816 - attack.T106917 behavior: "k8s:scan"18 label: "Kubernetes Service Account Denied Request"19 spoofable: 020 confidence: 321 service: k8s22