Elastic low stable kql

GKE Suspicious Self-Subject Review via Service Account

Detects GKE service account or node identities invoking self-subject access or rules review APIs. Non-human identities rarely enumerate their own permissions outside known controllers; this can indicate stolen tokens probing effective RBAC.

View Source

Detection Logic

data_stream.dataset:gcp.audit and service.name:k8s.io and event.action:(io.k8s.authorization.v1.selfsubjectaccessreviews.create or io.k8s.authorization.v1.selfsubjectrulesreviews.create) and user.email:((system\:node\:* or system\:serviceaccount\:*) and not ("system:serviceaccount:default:argo-argo-workflows-server" or "system:serviceaccount:default:argo-argo-workflows-workflow-controller" or system\:serviceaccount\:*\:datadog-kube-state-metrics))

False Positives

⚠ Some controllers and admin impersonation workflows legitimately submit self-subject reviews. Excluded identities include common Argo and Datadog service accounts.

Field Validations

Loading…

Comments (0)

Loading comments...