Elastic high stable kql

GKE Certificate Signing Request API Client Signer Requested

Detects creation of a GKE CertificateSigningRequest (CSR) that requests the kubernetes.io/kube-apiserver-client signer. This signer issues general API client certificates with few subject restrictions, unlike the restricted kubelet signers used for node certificate rotation. Attackers with CSR permissions use this signer to mint long-lived credentials for privileged identities such as system:kube-controller-manager, enabling persistence and privilege escalation that survives token revocation and RBAC changes.

View Source

Detection Logic

data_stream.dataset:"gcp.audit" and service.name:"k8s.io" and event.outcome:"success" and
event.action:"io.k8s.certificates.v1.certificatesigningrequests.create" and
gcp.audit.request.spec.signerName:"kubernetes.io/kube-apiserver-client" and
not client.user.email:(
  "system:gcp-controller-manager" or
  "system:serviceaccount:kube-system:certificate-controller"
)

False Positives

⚠ Custom PKI or administrative tooling may legitimately request kubernetes.io/kube-apiserver-client certificates in self-managed clusters. Baseline approved operators and tune exclusions for known automation on GKE.

Field Validations

Loading…

Comments (0)

Loading comments...