A Kubernetes service account executed an unusual API call

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-10-08

Synopsis

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	5 Days
Required Data	Requires one of the following data sources: AWS Audit Log OR Azure Audit Log OR Gcp Audit Log
Detection Modules	Cloud
Detector Tags	Kubernetes - API
ATT&CK Tactic	Execution (TA0002)
ATT&CK Technique	User Execution (T1204)
Severity	Informational

Description

A Kubernetes service account executed an unusual API call.

Attacker's Goals

Abuse a service account token to gain access to the Kubernetes cluster.

Investigative actions

Verify whether the service account should be executing this API.
Investigate other operations that were performed by the service account within the cluster.

Variations

A Kubernetes service account executed an API call on a first-seen resource

Synopsis

ATT&CK Tactic	Execution (TA0002)
ATT&CK Technique	User Execution (T1204)
Severity	Low

Description

A Kubernetes service account executed an API call on a first-seen resource.

Attacker's Goals

Abuse a service account token to gain access to the Kubernetes cluster.

Investigative actions

Verify whether the service account should be executing this API.
Investigate other operations that were performed by the service account within the cluster.

A Kubernetes service account executed an API call on an unusual sensitive resource

Synopsis

ATT&CK Tactic	Execution (TA0002)
ATT&CK Technique	User Execution (T1204)
Severity	Low

Description

A Kubernetes service account executed an API call on an unusual sensitive resource.

Attacker's Goals

Abuse a service account token to gain access to the Kubernetes cluster.

Investigative actions

Verify whether the service account should be executing this API.
Investigate other operations that were performed by the service account within the cluster.

A Kubernetes service account executed an unusual modification API call

Synopsis

ATT&CK Tactic	Execution (TA0002)
ATT&CK Technique	User Execution (T1204)
Severity	Informational

Description

A Kubernetes service account executed an unusual modification API call.

Attacker's Goals

Abuse a service account token to gain access to the Kubernetes cluster.

Investigative actions

Verify whether the service account should be executing this API.
Investigate other operations that were performed by the service account within the cluster.

A Kubernetes service account executed an API call on an unusual resource

Synopsis

ATT&CK Tactic	Execution (TA0002)
ATT&CK Technique	User Execution (T1204)
Severity	Informational

Description

A Kubernetes service account executed an API call on an unusual resource.

Attacker's Goals

Abuse a service account token to gain access to the Kubernetes cluster.

Investigative actions

Verify whether the service account should be executing this API.
Investigate other operations that were performed by the service account within the cluster.