Kubernetes API Audit: Unauthorized (401) or Forbidden (403) Access Attempts
Alerts on Kubernetes API audit events returning 401 or 403, indicating authentication or authorization failures.
FreeReviewedSigma · Low · v5
- Product
- kubernetes
- Service
- audit
- Author
- kelnage (SigmaHQ), DRL 1.1
- Published
- 2024-04-12
- Updated
- 2026-07-31
What it detects
This rule flags Kubernetes API requests that are rejected with HTTP 401 (Unauthorized) or 403 (Forbidden) responses. Such responses can indicate an attacker attempting to use invalid or expired credentials or bypass access controls. Detection relies on Kubernetes API audit logs capturing the response status code for each request.
Reporting behind it
- kubernetes.iohttps://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/
- datadoghq.comhttps://www.datadoghq.com/blog/monitor-kubernetes-audit-logs/#monitor-api-authentication-issues
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/application/kubernetes/audit/kubernetes_audit_unauthorized_unauthenticated_actions.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
kubernetes-api-audit-unauthorized-401-or-forbidden-403-access-attempts-0d933542
title: "Kubernetes API Audit: Unauthorized (401) or Forbidden (403) Access Attempts"
id: 2deff9f2-16d1-48eb-924e-7db2c7de262b
status: test
description: This rule flags Kubernetes API requests that are rejected with HTTP 401 (Unauthorized) or 403 (Forbidden) responses. Such responses can indicate an attacker attempting to use invalid or expired credentials or bypass access controls. Detection relies on Kubernetes API audit logs capturing the response status code for each request.
references:
- https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/
- https://www.datadoghq.com/blog/monitor-kubernetes-audit-logs/#monitor-api-authentication-issues
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/kubernetes/audit/kubernetes_audit_unauthorized_unauthenticated_actions.yml
author: kelnage, Huntrule Team
date: 2024-04-12
tags:
- attack.privilege-escalation
logsource:
product: kubernetes
service: audit
detection:
selection:
responseStatus.code:
- 401
- 403
condition: selection
falsepositives:
- A misconfigured RBAC policy, a mistake by a valid user, or a wider issue with authentication tokens can also generate these errors.
level: low
license: DRL-1.1
related:
- id: 0d933542-1f1f-420d-97d4-21b2c3c492d9
type: derived