Kubernetes Service Account Denied Request Detection Scenario by crowdsecurity | CrowdSec Hub

Kubernetes Service Account Denied Request

Attack scenariok8s:scanMITRE T1078MITRE T1069

By: crowdsecurity
Version: 0.4
Name: crowdsecurity/k8s-audit-service-account-access-denied

Detect unauthorized requests from service accounts

Install with a top-level collection

1 collection include it

sudo cscli collections install crowdsecurity/k8s-audit

Installs 1 parser and 7 scenarios.

View Kubernetes - Audit Detection →

Installation

sudo cscli scenarios install crowdsecurity/k8s-audit-service-account-access-denied

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/k8s-audit-service-account-access-denied.yaml· 21 linesGitHub

1type: trigger1
2name: crowdsecurity/k8s-audit-service-account-access-denied
3description: "Detect unauthorized requests from service accounts"
4filter: |2
5  evt.Meta.log_type == 'k8s-audit' &&
6  evt.Meta.user startsWith "system:serviceaccount:" &&
7  (
8   (evt.Meta.datasource_type == "k8s-audit" && evt.Unmarshaled.k8s_audit.Annotations["authorization.k8s.io/decision"] == "forbid")
9   ||
10   (evt.Meta.datasource_type != "k8s-audit" && evt.Unmarshaled.k8s_audit.annotations["authorization.k8s.io/decision"] == "forbid")
11  )
12labels:
13  notification: true
14  classification:3
15    - attack.T1078
16    - attack.T1069
17  behavior: "k8s:scan"
18  label: "Kubernetes Service Account Denied Request"
19  spoofable: 0
20  confidence: 3
21  service: k8s

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Detects service accounts making forbidden requests to the K8S API.

Only attempts done on resources that are logged at least at the Metadata level will be recorded.

No decision will be taken based on this scenario, it is only intended for notification purposes.