Possible Kubernetes Unauthorized or Unauthenticated Access (via audit)

title: Possible Kubernetes Unauthorized or Unauthenticated Access (via audit)
id: e1a334fb-d5ff-5f11-8047-c9235ba5f70e
status: stable
description: This rule detects when a request to the Kubernetes API is rejected due to lack of authorization or due to an expired authentication token being used. This may indicate an adversary attempting to abuse credentials they have obtained.
references:
    - https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/
    - https://www.datadoghq.com/blog/monitor-kubernetes-audit-logs/#monitor-api-authentication-issues
author: Huntrule Team
date: 2026-01-01
tags:
    - attack.privilege-escalation
    - attack.defense-evasion
    - attack.t1078
logsource:
    product: kubernetes
    service: audit
detection:
    selection:
        responseStatus.code:
            - 401
            - 403
    condition: selection
falsepositives:
    - Unknown
level: low