Kubernetes ServiceAccount Created via Audit Logging

Alerts on Kubernetes audit events showing new ServiceAccounts created.

FreeUnreviewedSigmalowv1

kubernetes-serviceaccount-created-via-audit-logging-e31bae15

title: Kubernetes ServiceAccount Created via Audit Logging
id: 06d76a5f-be48-4787-add9-0ee31cf435ca
related:
  - id: 12d027c3-b48c-4d9d-8bb6-a732200034b2
    type: derived
  - id: e31bae15-83ed-473e-bf31-faf4f8a17d36
    type: derived
status: test
description: This rule flags Kubernetes API audit events where a service account is created. Creating a new ServiceAccount can be used by an attacker to establish cluster access for persistence or to support subsequent actions. It relies on Kubernetes audit logs capturing requests with verb=create for the serviceaccounts resource.
references:
  - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/container%20service%20account/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/kubernetes/audit/kubernetes_audit_serviceaccount_creation.yml
author: Leo Tsaousis (@laripping), Huntrule Team
date: 2024-03-26
tags:
  - attack.persistence
  - attack.t1136
logsource:
  category: application
  product: kubernetes
  service: audit
detection:
  selection:
    verb: create
    objectRef.resource: serviceaccounts
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1

What it detects

This rule flags Kubernetes API audit events where a service account is created. Creating a new ServiceAccount can be used by an attacker to establish cluster access for persistence or to support subsequent actions. It relies on Kubernetes audit logs capturing requests with verb=create for the serviceaccounts resource.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.