huntrule

Kubernetes Service Account Created via Audit Log

Alerts on Kubernetes audit events showing new ServiceAccounts created.

FreeReviewedSigma · Low · v5
Product
kubernetes
Category
application
Author
Leo Tsaousis (@laripping) (SigmaHQ), DRL 1.1
Published
2024-03-26
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Persistence

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Kubernetes API audit events where a service account is created (resource type: serviceaccounts, verb: create). Creating service accounts can be used by attackers to establish new identities for persistence or future access within a cluster. The detection relies on Kubernetes audit log telemetry capturing the API verb and the target resource reference.

Reporting behind it

Related detections9 linkedT1136 — drag to rearrange
Possible Unauthenticated Admin Creation in Dynamicweb CVE-2022-25369
Renamed User Account Creation Disguised in a Computer Account (via security)
Malicious Fortinet APT Group Abuse on Windows - User (via security)
Malicious User Account Created by a Computer Account (via security)
Default Account Usage
Possible FortiWeb Authentication Bypass via Path Traversal to fwbcgi (via webserver)
Malicious SQL SA Admin User Enabled (via application)
Suspicious Hidden Account Creation - With Fast Deletion (via security)
Linux Process Creation: ESXi User Account Added via esxcli system account add
Kubernetes Service Account Created via Audit Log
Pivot detection · T1136 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.