Kubernetes Service Account Created via Audit Log
Alerts on Kubernetes audit events showing new ServiceAccounts created.
FreeReviewedSigma · Low · v5
- Product
- kubernetes
- Category
- application
- Author
- Leo Tsaousis (@laripping) (SigmaHQ), DRL 1.1
- Published
- 2024-03-26
- Updated
- 2026-07-31
ATT&CK techniques
PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Kubernetes API audit events where a service account is created (resource type: serviceaccounts, verb: create). Creating service accounts can be used by attackers to establish new identities for persistence or future access within a cluster. The detection relies on Kubernetes audit log telemetry capturing the API verb and the target resource reference.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
kubernetes-serviceaccount-created-via-audit-logging-e31bae15
title: Kubernetes Service Account Created via Audit Log
id: 06d76a5f-be48-4787-add9-0ee31cf435ca
related:
- id: 12d027c3-b48c-4d9d-8bb6-a732200034b2
type: derived
- id: e31bae15-83ed-473e-bf31-faf4f8a17d36
type: derived
status: test
description: "This rule flags Kubernetes API audit events where a service account is created (resource type: serviceaccounts, verb: create). Creating service accounts can be used by attackers to establish new identities for persistence or future access within a cluster. The detection relies on Kubernetes audit log telemetry capturing the API verb and the target resource reference."
references:
- https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/container%20service%20account/
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/kubernetes/audit/kubernetes_audit_serviceaccount_creation.yml
author: Leo Tsaousis (@laripping), Huntrule Team
date: 2024-03-26
tags:
- attack.persistence
- attack.t1136
logsource:
category: application
product: kubernetes
service: audit
detection:
selection:
verb: create
objectRef.resource: serviceaccounts
condition: selection
falsepositives:
- Unknown
level: low
license: DRL-1.1