Kubernetes API Audit: Unauthorized (401) or Forbidden (403) Access Attempts

Alerts on Kubernetes API audit events returning 401 or 403, indicating authentication or authorization failures.

FreeUnreviewedSigmalowv1

kubernetes-api-audit-unauthorized-401-or-forbidden-403-access-attempts-0d933542

title: "Kubernetes API Audit: Unauthorized (401) or Forbidden (403) Access Attempts"
id: 2deff9f2-16d1-48eb-924e-7db2c7de262b
status: test
description: This rule flags Kubernetes API requests recorded in audit logs that are rejected with HTTP 401 (Unauthorized) or 403 (Forbidden). Such failures indicate clients are either not authenticated, not authorized for the requested action, or using an expired authentication token. These events matter because attackers may probe API access or attempt privilege escalation with stolen or invalid credentials. The detection relies on Kubernetes audit log telemetry capturing the API response status code.
references:
  - https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/
  - https://www.datadoghq.com/blog/monitor-kubernetes-audit-logs/#monitor-api-authentication-issues
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/kubernetes/audit/kubernetes_audit_unauthorized_unauthenticated_actions.yml
author: kelnage, Huntrule Team
date: 2024-04-12
tags:
  - attack.privilege-escalation
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    responseStatus.code:
      - 401
      - 403
  condition: selection
falsepositives:
  - A misconfigured RBAC policy, a mistake by a valid user, or a wider issue with authentication tokens can also generate these errors.
level: low
license: DRL-1.1
related:
  - id: 0d933542-1f1f-420d-97d4-21b2c3c492d9
    type: derived

What it detects

This rule flags Kubernetes API requests recorded in audit logs that are rejected with HTTP 401 (Unauthorized) or 403 (Forbidden). Such failures indicate clients are either not authenticated, not authorized for the requested action, or using an expired authentication token. These events matter because attackers may probe API access or attempt privilege escalation with stolen or invalid credentials. The detection relies on Kubernetes audit log telemetry capturing the API response status code.

Known false positives

A misconfigured RBAC policy, a mistake by a valid user, or a wider issue with authentication tokens can also generate these errors.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.