Kubernetes Audit: SelfSubjectRulesReviews RBAC Permission Enumeration Attempt

title: "Kubernetes Audit: SelfSubjectRulesReviews RBAC Permission Enumeration Attempt"
id: 9acdd3ce-f9aa-45df-ab05-32856ba57243
status: test
description: This rule flags Kubernetes API audit events where a client creates selfsubjectrulesreviews under authorization.k8s.io, indicating an attempt to enumerate the caller’s effective RBAC permissions. Attackers and administrators may use this to quickly understand what actions their identity is allowed to perform inside the cluster, which can support subsequent discovery and privilege-focused activity. The detection relies on Kubernetes audit telemetry capturing the API call’s verb, API group, and target resource.
references:
  - https://www.elastic.co/guide/en/security/current/kubernetes-suspicious-self-subject-review.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/kubernetes/audit/kubernetes_audit_rbac_permisions_listing.yml
author: Leo Tsaousis (@laripping), Huntrule Team
date: 2024-03-26
tags:
  - attack.t1069.003
  - attack.t1087.004
  - attack.discovery
logsource:
  category: application
  product: kubernetes
  service: audit
detection:
  selection:
    verb: create
    apiGroup: authorization.k8s.io
    objectRef.resource: selfsubjectrulesreviews
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: 84b777bd-c946-4d17-aa2e-c39f5a454325
    type: derived