Elastic medium stable eql

Kubernetes Service Account Secret Access

This rule detects when a process accesses Kubernetes service account secrets. Kubernetes service account secrets are files that contain sensitive information used by applications running in Kubernetes clusters to authenticate and authorize access to the cluster. These secrets are typically mounted into pods at runtime, allowing applications to access them securely. Unauthorized access to these secrets can lead to privilege escalation, lateral movement and unauthorized actions within the cluster.

View Source

Detection Logic

process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and (
  process.command_line like (
    "*/run/secrets/kubernetes.io/serviceaccount*",
    "*/var/run/secrets/kubernetes.io/serviceaccount*",
    "*/secrets/kubernetes.io/serviceaccount*"
  ) or (
    process.working_directory like (
      "/run/secrets/kubernetes.io/serviceaccount",
      "/var/run/secrets/kubernetes.io/serviceaccount",
      "/secrets/kubernetes.io/serviceaccount"
    ) and
    process.args in ("ca.crt", "token")
  )
) and
not (
  process.command_line like "*/bin/test*" or
  process.args in (
    "/var/run/secrets/kubernetes.io/serviceaccount/namespace",
    "/run/secrets/kubernetes.io/serviceaccount/namespace",
    "/secrets/kubernetes.io/serviceaccount/namespace"
  ) or
  process.command_line == "/usr/bin/coreutils --coreutils-prog-shebang=cat /usr/bin/cat /var/run/secrets/kubernetes.io/serviceaccount/token" or
  process.parent.command_line == "runc init" or
  (process.parent.name == "px-oci-mon" and process.name == "rsync") or
  (
    process.parent.command_line == "sh /install-cni.sh" and
    process.working_directory like (
      "/opt/cni/bin", "/run/containerd/io.containerd.runtime.v2.task/k8s.io/*/opt/cni/bin"
    )
  ) or
  (process.working_directory like "/home/runner/_work/*" and process.parent.args like "/home/runner/_work/_temp/*.sh") or
  process.working_directory == "/opt/cni/bin"
)

Field Validations

Loading…

Comments (0)

Loading comments...