Denied API call by a Kubernetes service account

Cortex XDR Analytics Alert Reference by Alert name

Product: Cortex XDR
Last date published: 2024-10-08
Category: Analytics Alert Reference
Order: Alert name

Synopsis

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	5 Days
Required Data	Requires one of the following data sources: AWS Audit Log OR Azure Audit Log OR Gcp Audit Log
Detection Modules	Cloud
Detector Tags	Kubernetes - API
ATT&CK Tactic	Execution (TA0002)
ATT&CK Technique	User Execution (T1204)
Severity	Informational

Description

A Kubernetes service account API call was denied.

Attacker's Goals

Gain access to the Kubernetes cluster.

Investigative actions

Check whether the service account should be making this API call.
Check service account's activity, including additional executed API calls.

Variations

Denied API call by Kubernetes service account for the first time in the cluster

Synopsis

ATT&CK Tactic	Execution (TA0002)
ATT&CK Technique	User Execution (T1204)
Severity	Low

Description

A Kubernetes service account API call was denied.

Attacker's Goals

Gain access to the Kubernetes cluster.

Investigative actions

Check whether the service account should be making this API call.
Check service account's activity, including additional executed API calls.

Suspicious denied API call by a Kubernetes service account

Synopsis

ATT&CK Tactic	Execution (TA0002)
ATT&CK Technique	User Execution (T1204)
Severity	Informational

Description

A Kubernetes service account API call was denied.

Attacker's Goals

Gain access to the Kubernetes cluster.

Investigative actions

Check whether the service account should be making this API call.
Check service account's activity, including additional executed API calls.