detection.wiki

CertificateSigningRequests

OperationDescriptionSampleRule
get-certificatesigningrequestsYN
list-certificatesigningrequestsYN
watch-certificatesigningrequestsYN
create-certificatesigningrequestsCertificate signing request created (e.g. for TLS bootstrapping or privilege escalation via cert issuance).YY
update-certificatesigningrequestsModifies a pending CertificateSigningRequest's status. Elastic flags create/update/patch by a non-control-plane identity as cert-based privilege escalation.YY
patch-certificatesigningrequestsSame as update via patch. Elastic flags create/update/patch of a CSR by a non-control-plane identity as cert-based privilege escalation or self-approval.YY
delete-certificatesigningrequestsYN
deletecollection-certificatesigningrequestsYN
get-certificatesigningrequests-approvalYN
update-certificatesigningrequests-approvalCSR approval/denial (Kubernetes client-certificate privilege escalation path).YY
patch-certificatesigningrequests-approvalNY
get-certificatesigningrequests-statusYN
update-certificatesigningrequests-statusYN
patch-certificatesigningrequests-statusYN
any-certificatesigningrequestsSynthetic aggregation for rules that filter the certificatesigningrequests resource with no specific verb. Not a distinct audit record; hosts rule listings that key on objectRef.resource alone.NN

get certificatesigningrequests

#
Resource
certificatesigningrequests

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/certificates.k8s.io/v1/certificatesigningrequests/dw-harn-csr-10e47a",
  "verb": "get",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "certificatesigningrequests",
    "name": "dw-harn-csr-10e47a",
    "apiGroup": "certificates.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T04:49:00.174658Z",
  "stageTimestamp": "2026-07-02T04:49:00.175967Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

list certificatesigningrequests

#
Resource
certificatesigningrequests

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/certificates.k8s.io/v1/certificatesigningrequests?fieldSelector=metadata.name%3Ddw-harn-csr-83be6c",
  "verb": "list",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=97ca5ec05d5b7c1923d58d85f4449a4c26b2df61defa2a59b4045149ffed589e"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "certificatesigningrequests",
    "name": "dw-harn-csr-83be6c",
    "apiGroup": "certificates.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T22:49:23.995206Z",
  "stageTimestamp": "2026-07-02T22:49:23.996759Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

watch certificatesigningrequests

#
Resource
certificatesigningrequests

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/certificates.k8s.io/v1/certificatesigningrequests?resourceVersion=1467&timeout=3s&watch=true",
  "verb": "watch",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=97ca5ec05d5b7c1923d58d85f4449a4c26b2df61defa2a59b4045149ffed589e"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "certificatesigningrequests",
    "apiGroup": "certificates.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T22:49:20.345780Z",
  "stageTimestamp": "2026-07-02T22:49:23.360135Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

create certificatesigningrequests

#
Resource
certificatesigningrequests

Description

Certificate signing request created (e.g. for TLS bootstrapping or privilege escalation via cert issuance).

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/certificates.k8s.io/v1/certificatesigningrequests?fieldManager=kubectl-create&fieldValidation=Strict",
  "verb": "create",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "certificatesigningrequests",
    "name": "dw-harn-csr-10e47a",
    "apiGroup": "certificates.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 201
  },
  "requestObject": {
    "kind": "CertificateSigningRequest",
    "apiVersion": "certificates.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-csr-10e47a"
    },
    "spec": {
      "request": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURSBSRVFVRVNULS0tLS0KTUlJQ2JqQ0NBVllDQVFBd0tURVZNQk1HQTFVRUF3d01aSGN0YUdGeWJpMTFjMlZ5TVJBd0RnWURWUVFLREFkawpkeTFvWVhKdU1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBeFFQMHQwOHhVMGtVCnZqTXZJeGU4UDlzVjhkbkh4VkdHWFVxQjdJQzdGUnp0Nit1bDJVZEQzTmNrMU1aNGZuc3lNL241S09yUWNoN1gKOVJ0T29NVGhoVUJ6aksvR0cyTk1oT09JSjVEd25NWUFYWStIZm84RzVFN0pBbzJLWlNMZHo2UHZGWmYwa1o0Rgo1b01GajJSRTZrRWVlei94NTgrbkd6czBJZUZCNm1BU3V3Z3JHb1RyWUplcmZ5OVorUTMrcGRFb2VUdEYxWHpwCm5MOEJpTXkzNlBwc1duU1p3TDVYMFB3SElnZkc0ckZRcG00d1lDa2FuYWwyNXhZUXAwY3lyZWIrQmhMQU1hUG0KUE1XWnp5Q3NJcTNoR2gybmhJVGhMVUh0YjBVejRFQi9zdksxTnJ3YTU1SFlqUHE4VHBwbHlVZ1BTRXkxblhLWQora0ViQ1R5WTN3SURBUUFCb0FBd0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQkFFR2pBUHZndEdjWlNTc1JmRkU5Cjk2eWtVMlZub0owRWhINGo3aEIxYUZCdUE5akVRMVpRUnl4QnFuS2ZGQzRqK0toNUNjWXpTWWhNS3BadW90RC8KV3pXOTZqMDgyRHNpVFd6TTR3K1dhZUdmWEhRc3N6VHVlR3kzR0hwZG8yOW1xNGFOQU85SHhtODF4aXUyR000SApMUjllNVVDRSt4b0ZSVE16T21zbGJ1Y1NvRm5vMkUvcWZMbHhPQWY3WXg3TitFbFRDZ2hmR0dldjdjTXkwb0c0CnVXMlFwVk5vNDhneVpZMkFLZTVzQVZzYWgyWU1KY3VZeHM4bC9YT0RoeVlPaXZSZWRCWWorQ3A2WHkxWG04RFgKQ253cHE1RkExdnRSdmxwalY4aFpSN2FXTmZNNXRYNWVVM0JVKzhScXRWWnRZUFpxenVodFVTbVJ4SjlLVk0zVgpxbzQ9Ci0tLS0tRU5EIENFUlRJRklDQVRFIFJFUVVFU1QtLS0tLQo=",
      "signerName": "kubernetes.io/kube-apiserver-client",
      "expirationSeconds": 3600,
      "usages": [
        "client auth"
      ]
    },
    "status": {}
  },
  "responseObject": {
    "kind": "CertificateSigningRequest",
    "apiVersion": "certificates.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-csr-10e47a",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1857",
      "creationTimestamp": "2026-07-02T04:49:00Z"
    },
    "spec": {
      "request": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURSBSRVFVRVNULS0tLS0KTUlJQ2JqQ0NBVllDQVFBd0tURVZNQk1HQTFVRUF3d01aSGN0YUdGeWJpMTFjMlZ5TVJBd0RnWURWUVFLREFkawpkeTFvWVhKdU1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBeFFQMHQwOHhVMGtVCnZqTXZJeGU4UDlzVjhkbkh4VkdHWFVxQjdJQzdGUnp0Nit1bDJVZEQzTmNrMU1aNGZuc3lNL241S09yUWNoN1gKOVJ0T29NVGhoVUJ6aksvR0cyTk1oT09JSjVEd25NWUFYWStIZm84RzVFN0pBbzJLWlNMZHo2UHZGWmYwa1o0Rgo1b01GajJSRTZrRWVlei94NTgrbkd6czBJZUZCNm1BU3V3Z3JHb1RyWUplcmZ5OVorUTMrcGRFb2VUdEYxWHpwCm5MOEJpTXkzNlBwc1duU1p3TDVYMFB3SElnZkc0ckZRcG00d1lDa2FuYWwyNXhZUXAwY3lyZWIrQmhMQU1hUG0KUE1XWnp5Q3NJcTNoR2gybmhJVGhMVUh0YjBVejRFQi9zdksxTnJ3YTU1SFlqUHE4VHBwbHlVZ1BTRXkxblhLWQora0ViQ1R5WTN3SURBUUFCb0FBd0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQkFFR2pBUHZndEdjWlNTc1JmRkU5Cjk2eWtVMlZub0owRWhINGo3aEIxYUZCdUE5akVRMVpRUnl4QnFuS2ZGQzRqK0toNUNjWXpTWWhNS3BadW90RC8KV3pXOTZqMDgyRHNpVFd6TTR3K1dhZUdmWEhRc3N6VHVlR3kzR0hwZG8yOW1xNGFOQU85SHhtODF4aXUyR000SApMUjllNVVDRSt4b0ZSVE16T21zbGJ1Y1NvRm5vMkUvcWZMbHhPQWY3WXg3TitFbFRDZ2hmR0dldjdjTXkwb0c0CnVXMlFwVk5vNDhneVpZMkFLZTVzQVZzYWgyWU1KY3VZeHM4bC9YT0RoeVlPaXZSZWRCWWorQ3A2WHkxWG04RFgKQ253cHE1RkExdnRSdmxwalY4aFpSN2FXTmZNNXRYNWVVM0JVKzhScXRWWnRZUFpxenVodFVTbVJ4SjlLVk0zVgpxbzQ9Ci0tLS0tRU5EIENFUlRJRklDQVRFIFJFUVVFU1QtLS0tLQo=",
      "signerName": "kubernetes.io/kube-apiserver-client",
      "expirationSeconds": 3600,
      "usages": [
        "client auth"
      ],
      "username": "kubernetes-admin",
      "groups": [
        "kubeadm:cluster-admins",
        "system:authenticated"
      ],
      "extra": {
        "authentication.kubernetes.io/credential-id": [
          "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
        ]
      }
    },
    "status": {}
  },
  "requestReceivedTimestamp": "2026-07-02T04:49:00.110324Z",
  "stageTimestamp": "2026-07-02T04:49:00.114882Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
ServiceName (elastic rule field)eqk8s.io4 ruleselastic
EventType (elastic rule field)eqio.k8s.certificates.v1.certificatesigningrequests.create2 ruleselastic
EventType (elastic rule field)inio.k8s.certificates.v1.certificatesigningrequests.approval.update2 ruleselastic
EventType (elastic rule field)inio.k8s.certificates.v1.certificatesigningrequests.create2 ruleselastic
azure.platformlogs.category (elastic rule field)inkube-audit1 ruleelastic
azure.platformlogs.category (elastic rule field)inkube-audit-admin1 ruleelastic
azure.platformlogs.properties.log.stage (elastic rule field)eqresponsecomplete1 ruleelastic
azure.platformlogs.properties.log.verb (elastic rule field)eqcreate1 ruleelastic
azure.platformlogs.properties.log.verb (elastic rule field)inpatch1 ruleelastic
azure.platformlogs.properties.log.verb (elastic rule field)inupdate1 ruleelastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • Azure AKS Certificate Signing Request Created or Approved source medium: Detects an identity creating a client-authentication CertificateSigningRequest (signer kubernetes.io/kube-apiserver-client) or approving a CSR on AKS (Azure Kubernetes Service), excluding node bootstrap and platform controllers. Adversaries submit and self-approve a CSR against the kube-apiserver-client signer to mint a long-lived client certificate for an arbitrary subject (for example a Common Name in system:masters), giving durable authenticated access that survives token revocation. Coverage includes workload service accounts (system:serviceaccount:*), so a compromised in-cluster token forging a certificate is not excluded.T1649↳ also matches update-certificatesigningrequests-approval: update certificatesigningrequests/approval, patch-certificatesigningrequests-approval: patch certificatesigningrequests/approval
    Investigation guide

    Triage and analysis#

    Investigating Azure AKS Certificate Signing Request Created or Approved#

    AKS kube-audit events are carried under the flattened azure.platformlogs.properties.log.* subtree and share the ARM operation event.action: Microsoft.ContainerService/managedClusters/diagnosticLogs/Read. A CSR created against the kubernetes.io/kube-apiserver-client signer lets the requester choose the certificate's subject (Common Name and organization/groups); once approved it mints a client certificate for an arbitrary identity that yields access not tied to a token. The default CertificateSubjectRestriction admission controller blocks requests for the system:masters group, so attackers commonly request a Common Name matching an existing privileged user (or another privileged group) instead, making the requested subject the key thing to decode. Node and kubelet certificates use the kube-apiserver-client-kubelet and kubelet-serving signers (whose subject is constrained to the node) and are out of scope; cert-manager and application CSRs use their own signers.

    Possible investigation steps#

    • Identify the requesting identity in azure.platformlogs.properties.log.user.username (and its groups in azure.platformlogs.properties.log.user.groups) and whether it should submit or approve CSRs. A workload service account (system:serviceaccount:<ns>:<sa>) or masterclient (the local cluster-admin cert) is the higher-concern case.
    • Confirm the signer in azure.platformlogs.properties.log.requestObject.spec.signerName and decode the base64 CSR in azure.platformlogs.properties.log.requestObject.spec.request to read the requested Common Name and organization (groups); a subject in system:masters or another privileged group is the escalation.
    • Determine whether the same or a related identity approved the CSR (verb:update/patch on the approval subresource), which indicates self-approval, and inspect azure.platformlogs.properties.log.userAgent.
    • Evaluate the source in azure.platformlogs.properties.log.sourceIPs and pivot on it for follow-on privileged API activity using the newly issued certificate.

    False positive analysis#

    • Node bootstrap (kube-apiserver-client-kubelet signer), kubelet-serving CSRs, and cert-manager/application CSRs (custom signers) are out of scope by design; the kube-controller-manager certificate-controller and the AKS aksService approver are excluded by identity.
    • Manual CSR approval by an administrator, or an operator that legitimately mints client certificates, may surface; baseline those identities and exclude the specific validated account rather than re-broadening to all system:*, which would blind the rule to compromised workload service accounts.

    Response and remediation#

    • If unauthorized, deny or delete the CSR, revoke the issued certificate, and rotate the cluster CA if a privileged certificate was minted.
    • Review the RBAC that allowed CSR creation and approval, and audit actions taken with the certificate.
    • Collect kube-audit and identity artifacts per incident response procedures.
  • GKE Certificate Signing Request Self-Approved source high: Detects when the same non-system GKE identity creates a CertificateSigningRequest (CSR) and then approves that same CSR within five minutes, consistent with self-approval abuse. Attackers who gain CSR create and approval RBAC can submit a certificate request and approve it themselves to obtain a long-lived client certificate without involving cluster operators, a pattern documented in Kubernetes persistence research and adversary emulation.T1098, T1098.006↳ also matches update-certificatesigningrequests-approval: update certificatesigningrequests/approval
    Investigation guide

    Triage and analysis#

    Investigating GKE Certificate Signing Request Self-Approved#

    This rule groups CSR create and approval events by client.user.email and normalized CSR name (Esql.csr_name). GKE logs approval on subresource paths (.../csr-name/approval), so the query strips /approval suffixes before correlating. An alert means the same identity both submitted and approved the same CSR within five minutes, a strong indicator of manual self-approval rather than normal system:gcp-controller-manager auto-approval of node certificates.

    Possible investigation steps#

    • Review Esql.event_action_values for the sequence of create followed by approval.update.
    • Inspect gcp.audit.request.spec.signerName and decode gcp.audit.request.spec.request on create events for the requested identity.
    • Validate whether the actor should hold both CSR create and approval permissions.
    • Hunt for subsequent API activity authenticated as the minted certificate identity.

    False positive analysis#

    • cert-manager or internal PKI automation that creates and approves CSRs under the same service account in one workflow.
    • GitOps or bootstrap tooling that submits and signs CSRs programmatically. Baseline known automation and tune exclusions for those principals.
    • Two unrelated CSR events from the same user within five minutes should not match because the query requires at least one create and one approval-class action on the same normalized CSR name.
    • GKE Certificate Signing Request API Client Signer Requested - 1e344fba-a2f7-462b-aaec-d6c8f80d5a28
    • GKE Certificate Signing Request Privileged Identity Requested - 4159bec9-76ad-4cdc-a797-4a8572073bbe
    • GKE Client Certificate Signing Request Created or Approved - ec67ab57-945a-4edb-84f8-1d7a51f46544

    Response and remediation#

    • Revoke or deny the CSR, remove approval RBAC from untrusted principals, and rotate cluster signing credentials if abuse is confirmed.
  • GKE Client Certificate Signing Request Created or Approved source medium: Detects creation or approval of a GKE CertificateSigningRequest (CSR) by a non-system identity. This is a breadth baseline rule for human or custom automation CSR activity on GKE. Attackers with cluster access can submit and approve CSRs to obtain long-lived client certificates that survive token revocation and RBAC changes. Use companion rules to evaluate signer choice, requested identity, and self-approval behavior.T1098, T1098.006↳ also matches update-certificatesigningrequests-approval: update certificatesigningrequests/approval
    Investigation guide

    Triage and analysis#

    Investigating GKE Client Certificate Signing Request Created or Approved#

    Identify the actor (client.user.email), source.ip, and user_agent.original. Confirm whether the principal is expected to create or approve CSRs. Review event.action, gcp.audit.resource_name, and when audit level captures request bodies, the CSR spec in gcp.audit.request (requested signer, usages, and requested identity / Common Name).

    Extracting the Certificate Common Name#

    For create events, gcp.audit.request.spec.request may hold the base64-encoded PEM certificate signing request. On GKE this is base64 of the full PEM CSR. Decode and inspect the subject for high-risk Common Names such as system:masters, system:kube-controller-manager, and system:admin. The companion rule "GKE Certificate Signing Request Privileged Identity Requested" decodes the CSR body and matches those identities automatically.

    # Full decoded PEM block
echo "<gcp.audit.request.spec.request>" | base64 -d

# Parsed CSR details (subject, key type/size, extensions, signature)
echo "<gcp.audit.request.spec.request>" | base64 -d | openssl req -noout -text

# Subject only
echo "<gcp.audit.request.spec.request>" | base64 -d | openssl req -noout -subject

    Priority CNs that usually indicate privilege escalation intent:

    • system:masters (cluster-admin group)
    • system:kube-controller-manager (broad control-plane-style access, including secrets and token minting)
    • system:kube-scheduler (scheduling across the cluster)
    • system:kube-proxy (node/network-adjacent access)
    • Any CN that matches an existing ClusterRoleBinding subject name

    Possible investigation steps#

    • Compare the CSR name and extracted CN against approved PKI or bootstrap processes.
    • Determine whether the same identity both created and approved the CSR in a short window (approval.update, update, or patch), which matches self-approval abuse.
    • Review gcp.audit.resource_name and subsequent authentication or API activity from unusual networks.
    • Correlate with RBAC changes, secret access, or TokenRequest activity that preceded CSR activity.

    False positive analysis#

    • Admins testing CSR workflows with kubectl are common in lab clusters. Baseline expected operators and tune exclusions.
    • cert-manager or custom PKI automation outside the exclusion list may create or approve CSRs during normal rotation.
    • GKE Certificate Signing Request API Client Signer Requested - 1e344fba-a2f7-462b-aaec-d6c8f80d5a28
    • GKE Certificate Signing Request Privileged Identity Requested - 4159bec9-76ad-4cdc-a797-4a8572073bbe
    • GKE Certificate Signing Request Self-Approved - e155e658-3dcd-4d27-a4e5-1d8da6704b0e

    Response and remediation#

    • If malicious, deny further approval, delete or deny the CSR per incident policy, revoke or rotate cluster signing trust if the CA or signer was abused, and invalidate issued credentials.
    • Remove excessive RBAC that allows certificatesigningrequests create/update/patch or approval for untrusted identities; enforce signer restrictions and approved issuers where supported.

Show 3 more (6 total) on the rules page

Panther #

  • Kubernetes Client Certificate Credential Created source informational: Detects the creation of client certificate signing requests (CSRs) for Kubernetes API authentication. Attackers with appropriate RBAC permissions can create and approve client certificates to establish persistent access to the cluster. Client certificates provide long-term authentication that bypasses service account token expiration and can be harder to revoke. This technique is documented by Stratus Red Team as a persistence mechanism.T1098, T1552

References #

update certificatesigningrequests

#
Resource
certificatesigningrequests

Description

Modifies a pending CertificateSigningRequest's status. Elastic flags create/update/patch by a non-control-plane identity as cert-based privilege escalation.

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/certificates.k8s.io/v1/certificatesigningrequests/dw-harn-csr-83be6c?fieldManager=kubectl-replace&fieldValidation=Strict",
  "verb": "update",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=97ca5ec05d5b7c1923d58d85f4449a4c26b2df61defa2a59b4045149ffed589e"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "certificatesigningrequests",
    "name": "dw-harn-csr-83be6c",
    "uid": "00000000-0000-0000-0000-000000000000",
    "apiGroup": "certificates.k8s.io",
    "apiVersion": "v1",
    "resourceVersion": "1475"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {
    "kind": "CertificateSigningRequest",
    "apiVersion": "certificates.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-csr-83be6c",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1475",
      "creationTimestamp": "2026-07-02T22:49:20Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "request": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURSBSRVFVRVNULS0tLS0KTUlJQ2JqQ0NBVllDQVFBd0tURVZNQk1HQTFVRUF3d01aSGN0YUdGeWJpMTFjMlZ5TVJBd0RnWURWUVFLREFkawpkeTFvWVhKdU1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBM0EzMzdTdmY5a3RKCmxzeUhZWG5zcXRtWGp5dC9CSGQ2cGNGY1RNN3UyZ1lFK2JodlVjTnR0c3N3M3ptMFpFQ0Z6SC9SUFo1VE8yamIKV2hKaytORXFuTlYvVjVxaEV3clM5TVNhNVdzRnVTWFc2Mms2VkVtdHEwV3VpMlZsd1lrK0g2b05LRVJVYkVWVwpLN0tBaTY4MkRHV2ZJT1hZSjNrVExxT0laSlBRcnFhNVNtSEx0NVR1dkpKSDEvTzgrelF1NUxXNGpLK3lOWnB0ClZRM3hjQmJTM2hUTGpPTWpxQXZDY3VsN2pwMjNQRTFHQzN5cjRCbVZoUVJibFg5dTRqeTlkRFpzSEF6UG1BRnMKTE83RHk0ZDREcitaSFF6UU56bnluNWFkNWVyeXN4cnJ1dlJ1VTYwK1Qza1AvUlp0SjFmNnJDcnFubWx6N3NqWQpyZ0RNQ3RRUnhRSURBUUFCb0FBd0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQkFNb0dEbW5zU3V4MUE1SE5QcG90CkIyNWZJc3dvNVNwRkxjaDFDa2V6cm45UmxNS2Q0b3NvczlFRUR3SUxKSHlwdEVxU2pnRlpMR0FWZGM1Nks3ckkKaVhKbUFISDBxZ3Q1ZUR0eG9sU1J2R2pQUVQrbW1NZ0RJRS9MNW9FMkROQ3d2T2NraUYzWGM1YktZczBkV2FpUApOOFlzeDdrNmRQRDdQdENESkt2VTM1eEp3NlJTZmpUczVQdTZMbEh5UFpkZy81UG5OUzZCNFZkWS9CNUpMa3N6Ck1hZDRLbDE3YU9WUE1wQThoaklmZHZWNHhWMTJ3VkF0WUJ6T3p3WngwZTFTeW96VWE0c1RZQWs0eUxlV0Fzbm0KNStheXhDbjRMQkVSaVBCUVZ5OEE0SWtuS2ppZFd2MFVrcHM5NkVUS2w0M2YweEdOYWk3MlllcDZVbDgxRkhTdgo3aW89Ci0tLS0tRU5EIENFUlRJRklDQVRFIFJFUVVFU1QtLS0tLQo=",
      "signerName": "kubernetes.io/kube-apiserver-client",
      "expirationSeconds": 3600,
      "usages": [
        "client auth"
      ],
      "username": "kubernetes-admin",
      "groups": [
        "kubeadm:cluster-admins",
        "system:authenticated"
      ],
      "extra": {
        "authentication.kubernetes.io/credential-id": [
          "X509SHA256=97ca5ec05d5b7c1923d58d85f4449a4c26b2df61defa2a59b4045149ffed589e"
        ]
      }
    },
    "status": {}
  },
  "responseObject": {
    "kind": "CertificateSigningRequest",
    "apiVersion": "certificates.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-csr-83be6c",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1475",
      "creationTimestamp": "2026-07-02T22:49:20Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "request": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURSBSRVFVRVNULS0tLS0KTUlJQ2JqQ0NBVllDQVFBd0tURVZNQk1HQTFVRUF3d01aSGN0YUdGeWJpMTFjMlZ5TVJBd0RnWURWUVFLREFkawpkeTFvWVhKdU1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBM0EzMzdTdmY5a3RKCmxzeUhZWG5zcXRtWGp5dC9CSGQ2cGNGY1RNN3UyZ1lFK2JodlVjTnR0c3N3M3ptMFpFQ0Z6SC9SUFo1VE8yamIKV2hKaytORXFuTlYvVjVxaEV3clM5TVNhNVdzRnVTWFc2Mms2VkVtdHEwV3VpMlZsd1lrK0g2b05LRVJVYkVWVwpLN0tBaTY4MkRHV2ZJT1hZSjNrVExxT0laSlBRcnFhNVNtSEx0NVR1dkpKSDEvTzgrelF1NUxXNGpLK3lOWnB0ClZRM3hjQmJTM2hUTGpPTWpxQXZDY3VsN2pwMjNQRTFHQzN5cjRCbVZoUVJibFg5dTRqeTlkRFpzSEF6UG1BRnMKTE83RHk0ZDREcitaSFF6UU56bnluNWFkNWVyeXN4cnJ1dlJ1VTYwK1Qza1AvUlp0SjFmNnJDcnFubWx6N3NqWQpyZ0RNQ3RRUnhRSURBUUFCb0FBd0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQkFNb0dEbW5zU3V4MUE1SE5QcG90CkIyNWZJc3dvNVNwRkxjaDFDa2V6cm45UmxNS2Q0b3NvczlFRUR3SUxKSHlwdEVxU2pnRlpMR0FWZGM1Nks3ckkKaVhKbUFISDBxZ3Q1ZUR0eG9sU1J2R2pQUVQrbW1NZ0RJRS9MNW9FMkROQ3d2T2NraUYzWGM1YktZczBkV2FpUApOOFlzeDdrNmRQRDdQdENESkt2VTM1eEp3NlJTZmpUczVQdTZMbEh5UFpkZy81UG5OUzZCNFZkWS9CNUpMa3N6Ck1hZDRLbDE3YU9WUE1wQThoaklmZHZWNHhWMTJ3VkF0WUJ6T3p3WngwZTFTeW96VWE0c1RZQWs0eUxlV0Fzbm0KNStheXhDbjRMQkVSaVBCUVZ5OEE0SWtuS2ppZFd2MFVrcHM5NkVUS2w0M2YweEdOYWk3MlllcDZVbDgxRkhTdgo3aW89Ci0tLS0tRU5EIENFUlRJRklDQVRFIFJFUVVFU1QtLS0tLQo=",
      "signerName": "kubernetes.io/kube-apiserver-client",
      "expirationSeconds": 3600,
      "usages": [
        "client auth"
      ],
      "username": "kubernetes-admin",
      "groups": [
        "kubeadm:cluster-admins",
        "system:authenticated"
      ],
      "extra": {
        "authentication.kubernetes.io/credential-id": [
          "X509SHA256=97ca5ec05d5b7c1923d58d85f4449a4c26b2df61defa2a59b4045149ffed589e"
        ]
      }
    },
    "status": {}
  },
  "requestReceivedTimestamp": "2026-07-02T22:49:23.581773Z",
  "stageTimestamp": "2026-07-02T22:49:23.584217Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • Kubernetes Client Certificate Signing Request Created or Approved source high: Detects creation or approval of a Kubernetes CertificateSigningRequest (CSR) by a non-system identity. Attackers who have gained cluster access can submit a CSR with a privileged Common Name such as system:kube-controller-manager or system:masters, then approve it themselves to obtain a long-lived client certificate. Unlike service account tokens which expire in hours, client certificates persist until they expire or the cluster CA is rotated, providing durable access that survives pod termination, token revocation, and RBAC changes. On non-EKS clusters, the signed certificate allows the attacker to authenticate as the privileged identity from anywhere without needing cluster network access, making it one of the most persistent backdoor mechanisms available in Kubernetes.T1098, T1098.006↳ also matches create-certificatesigningrequests: create certificatesigningrequests, patch-certificatesigningrequests: patch certificatesigningrequests
    Investigation guide

    Triage and analysis#

    Investigating Kubernetes Client Certificate Signing Request Created or Approved#

    Identify the actor (user.name, groups), client (user_agent.original), and source.ip. Confirm whether the principal is expected to create or approve CSRs. Review kubernetes.audit.requestURI and, when audit level captures request bodies, the CSR spec (requested signer, usages, and requested identity / Common Name).

    Extracting the Certificate Common Name#

    For create events, "kubernetes.audit.requestObject.spec.request" holds the base64-encoded PEM certificate signing request. Decode that value to PEM, then inspect the CSR subject (for example with OpenSSL’s CSR subject view) to read the requested Common Name (CN).

    Known base64 substrings that often appear inside the encoded request for high-risk identities:

    • c3lzdGVtOm1hc3Rlcn — system:masters
    • c3lzdGVtOmt1YmUtY29udHJvbGxlci1tYW5hZ2Vy — system:kube-controller-manager
    • c3lzdGVtOmFkbWlu — system:admin

    Priority CNs that usually indicate privilege escalation intent:

    • system:masters (cluster-admin group)
    • system:kube-controller-manager (broad control-plane–style access, including secrets and token minting)
    • system:kube-scheduler (scheduling across the cluster)
    • system:kube-proxy (node/network–adjacent access)
    • Any CN that matches an existing ClusterRoleBinding subject name

    Possible investigation steps#

    • Compare the CSR name and extracted CN against approved PKI or bootstrap processes.
    • Determine whether the same identity both created and approved or patched the CSR in a short window, which matches self-approval abuse.
    • Review kubernetes.audit.objectRef and subsequent authentication or API activity from unusual networks.
    • Correlate with RBAC changes, secret access, or TokenRequest activity that preceded CSR activity.

    Response and remediation#

    • If malicious, deny further approval, delete or deny the CSR per incident policy, revoke or rotate cluster signing trust if the CA or signer was abused, and invalidate issued credentials.
    • Remove excessive RBAC that allows certificatesigningrequests create/update/patch or approval for untrusted identities; enforce signer restrictions and approved issuers where supported.

References #

patch certificatesigningrequests

#
Resource
certificatesigningrequests

Description

Same as update via patch. Elastic flags create/update/patch of a CSR by a non-control-plane identity as cert-based privilege escalation or self-approval.

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/certificates.k8s.io/v1/certificatesigningrequests/dw-harn-csr-83be6c?fieldManager=kubectl-patch",
  "verb": "patch",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=97ca5ec05d5b7c1923d58d85f4449a4c26b2df61defa2a59b4045149ffed589e"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "certificatesigningrequests",
    "name": "dw-harn-csr-83be6c",
    "apiGroup": "certificates.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {
    "metadata": {
      "labels": {
        "dw-harn-patched": "1"
      }
    }
  },
  "responseObject": {
    "kind": "CertificateSigningRequest",
    "apiVersion": "certificates.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-csr-83be6c",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1475",
      "creationTimestamp": "2026-07-02T22:49:20Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "request": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURSBSRVFVRVNULS0tLS0KTUlJQ2JqQ0NBVllDQVFBd0tURVZNQk1HQTFVRUF3d01aSGN0YUdGeWJpMTFjMlZ5TVJBd0RnWURWUVFLREFkawpkeTFvWVhKdU1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBM0EzMzdTdmY5a3RKCmxzeUhZWG5zcXRtWGp5dC9CSGQ2cGNGY1RNN3UyZ1lFK2JodlVjTnR0c3N3M3ptMFpFQ0Z6SC9SUFo1VE8yamIKV2hKaytORXFuTlYvVjVxaEV3clM5TVNhNVdzRnVTWFc2Mms2VkVtdHEwV3VpMlZsd1lrK0g2b05LRVJVYkVWVwpLN0tBaTY4MkRHV2ZJT1hZSjNrVExxT0laSlBRcnFhNVNtSEx0NVR1dkpKSDEvTzgrelF1NUxXNGpLK3lOWnB0ClZRM3hjQmJTM2hUTGpPTWpxQXZDY3VsN2pwMjNQRTFHQzN5cjRCbVZoUVJibFg5dTRqeTlkRFpzSEF6UG1BRnMKTE83RHk0ZDREcitaSFF6UU56bnluNWFkNWVyeXN4cnJ1dlJ1VTYwK1Qza1AvUlp0SjFmNnJDcnFubWx6N3NqWQpyZ0RNQ3RRUnhRSURBUUFCb0FBd0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQkFNb0dEbW5zU3V4MUE1SE5QcG90CkIyNWZJc3dvNVNwRkxjaDFDa2V6cm45UmxNS2Q0b3NvczlFRUR3SUxKSHlwdEVxU2pnRlpMR0FWZGM1Nks3ckkKaVhKbUFISDBxZ3Q1ZUR0eG9sU1J2R2pQUVQrbW1NZ0RJRS9MNW9FMkROQ3d2T2NraUYzWGM1YktZczBkV2FpUApOOFlzeDdrNmRQRDdQdENESkt2VTM1eEp3NlJTZmpUczVQdTZMbEh5UFpkZy81UG5OUzZCNFZkWS9CNUpMa3N6Ck1hZDRLbDE3YU9WUE1wQThoaklmZHZWNHhWMTJ3VkF0WUJ6T3p3WngwZTFTeW96VWE0c1RZQWs0eUxlV0Fzbm0KNStheXhDbjRMQkVSaVBCUVZ5OEE0SWtuS2ppZFd2MFVrcHM5NkVUS2w0M2YweEdOYWk3MlllcDZVbDgxRkhTdgo3aW89Ci0tLS0tRU5EIENFUlRJRklDQVRFIFJFUVVFU1QtLS0tLQo=",
      "signerName": "kubernetes.io/kube-apiserver-client",
      "expirationSeconds": 3600,
      "usages": [
        "client auth"
      ],
      "username": "kubernetes-admin",
      "groups": [
        "kubeadm:cluster-admins",
        "system:authenticated"
      ],
      "extra": {
        "authentication.kubernetes.io/credential-id": [
          "X509SHA256=97ca5ec05d5b7c1923d58d85f4449a4c26b2df61defa2a59b4045149ffed589e"
        ]
      }
    },
    "status": {}
  },
  "requestReceivedTimestamp": "2026-07-02T22:49:23.432961Z",
  "stageTimestamp": "2026-07-02T22:49:23.438428Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • Kubernetes Client Certificate Signing Request Created or Approved source high: Detects creation or approval of a Kubernetes CertificateSigningRequest (CSR) by a non-system identity. Attackers who have gained cluster access can submit a CSR with a privileged Common Name such as system:kube-controller-manager or system:masters, then approve it themselves to obtain a long-lived client certificate. Unlike service account tokens which expire in hours, client certificates persist until they expire or the cluster CA is rotated, providing durable access that survives pod termination, token revocation, and RBAC changes. On non-EKS clusters, the signed certificate allows the attacker to authenticate as the privileged identity from anywhere without needing cluster network access, making it one of the most persistent backdoor mechanisms available in Kubernetes.T1098, T1098.006↳ also matches create-certificatesigningrequests: create certificatesigningrequests, update-certificatesigningrequests: update certificatesigningrequests
    Investigation guide

    Triage and analysis#

    Investigating Kubernetes Client Certificate Signing Request Created or Approved#

    Identify the actor (user.name, groups), client (user_agent.original), and source.ip. Confirm whether the principal is expected to create or approve CSRs. Review kubernetes.audit.requestURI and, when audit level captures request bodies, the CSR spec (requested signer, usages, and requested identity / Common Name).

    Extracting the Certificate Common Name#

    For create events, "kubernetes.audit.requestObject.spec.request" holds the base64-encoded PEM certificate signing request. Decode that value to PEM, then inspect the CSR subject (for example with OpenSSL’s CSR subject view) to read the requested Common Name (CN).

    Known base64 substrings that often appear inside the encoded request for high-risk identities:

    • c3lzdGVtOm1hc3Rlcn — system:masters
    • c3lzdGVtOmt1YmUtY29udHJvbGxlci1tYW5hZ2Vy — system:kube-controller-manager
    • c3lzdGVtOmFkbWlu — system:admin

    Priority CNs that usually indicate privilege escalation intent:

    • system:masters (cluster-admin group)
    • system:kube-controller-manager (broad control-plane–style access, including secrets and token minting)
    • system:kube-scheduler (scheduling across the cluster)
    • system:kube-proxy (node/network–adjacent access)
    • Any CN that matches an existing ClusterRoleBinding subject name

    Possible investigation steps#

    • Compare the CSR name and extracted CN against approved PKI or bootstrap processes.
    • Determine whether the same identity both created and approved or patched the CSR in a short window, which matches self-approval abuse.
    • Review kubernetes.audit.objectRef and subsequent authentication or API activity from unusual networks.
    • Correlate with RBAC changes, secret access, or TokenRequest activity that preceded CSR activity.

    Response and remediation#

    • If malicious, deny further approval, delete or deny the CSR per incident policy, revoke or rotate cluster signing trust if the CA or signer was abused, and invalidate issued credentials.
    • Remove excessive RBAC that allows certificatesigningrequests create/update/patch or approval for untrusted identities; enforce signer restrictions and approved issuers where supported.

References #

delete certificatesigningrequests

#
Resource
certificatesigningrequests

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/certificates.k8s.io/v1/certificatesigningrequests/dw-harn-csr-10e47a",
  "verb": "delete",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "certificatesigningrequests",
    "name": "dw-harn-csr-10e47a",
    "apiGroup": "certificates.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "status": "Success",
    "details": {
      "name": "dw-harn-csr-10e47a",
      "group": "certificates.k8s.io",
      "kind": "certificatesigningrequests",
      "uid": "00000000-0000-0000-0000-000000000000"
    },
    "code": 200
  },
  "requestObject": {
    "kind": "DeleteOptions",
    "apiVersion": "meta.k8s.io/__internal",
    "propagationPolicy": "Background"
  },
  "responseObject": {
    "kind": "Status",
    "apiVersion": "v1",
    "metadata": {},
    "status": "Success",
    "details": {
      "name": "dw-harn-csr-10e47a",
      "group": "certificates.k8s.io",
      "kind": "certificatesigningrequests",
      "uid": "00000000-0000-0000-0000-000000000000"
    }
  },
  "requestReceivedTimestamp": "2026-07-02T04:49:00.304408Z",
  "stageTimestamp": "2026-07-02T04:49:00.307279Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

deletecollection certificatesigningrequests

#
Resource
certificatesigningrequests

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/certificates.k8s.io/v1/certificatesigningrequests?labelSelector=dw-harn-patched",
  "verb": "deletecollection",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=3ffde68ef687218e01296d94b0aa59c81cc98de2bd73ab70e21510c8cd4b9cec"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "certificatesigningrequests",
    "apiGroup": "certificates.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "responseObject": {
    "kind": "CertificateSigningRequestList",
    "apiVersion": "certificates.k8s.io/v1",
    "metadata": {
      "resourceVersion": "1482"
    },
    "items": [
      {
        "metadata": {
          "name": "dw-harn-csr-30f363",
          "uid": "00000000-0000-0000-0000-000000000000",
          "resourceVersion": "1480",
          "creationTimestamp": "2026-07-02T23:16:10Z",
          "labels": {
            "dw-harn-patched": "1"
          }
        },
        "spec": {
          "request": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURSBSRVFVRVNULS0tLS0KTUlJQ2JqQ0NBVllDQVFBd0tURVZNQk1HQTFVRUF3d01aSGN0YUdGeWJpMTFjMlZ5TVJBd0RnWURWUVFLREFkawpkeTFvWVhKdU1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBb3pDQWlXSStHdk1lCnRMb0J2QnJKa2lhQU45L0lSaGloN2orQnB5Mk1RYnExTWxFY0hlSkp4bW9CMjZ5WTdUME5oQnY0Z0ZHdk80STcKVTNBRE5iTENDdXF5dmpqOEdKRldYM3M1VGNMQmVCeFNzRjhQSWNhazU5eHZVVXlJL24yOU5DTEpObXJMeVNOSApRcGVwOWp1bnE2WUtjTjNWY2hwcC9TeDQ0cXJWK2VzeTl2Z3pndHFLNjdObVpuWTJVZWhQZ2U3S0RRQmZJd1g5ClVBTVVTdXFTTGFTWndNTDY0U0hUOTVOQ2hpWXpLZ3EzOWM4R1k4RXBmUkVNY3djOGdGbml1V0x6MmZZUW1wWmgKWG5uYWY0a0dQbEJjdm9wOUM3Q0hCVzBPRnhlbjhGM0FnTW9BdkRrenp2VlRSK3FtWTd6aUQrQ3AyWmR2akZwNwphWU4zeVFId2p3SURBUUFCb0FBd0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQkFJc05nSXczdnI0SjdZS2hVWGpMCldVa2ppaThaSzJJaTUwWTdZcGtJbUJSRlMrb1hkNHFtWkU2WUpoMDRxVGNOUUVLZTRXK1pSUzdkMlRWVGZjK04KdkdnZ0NDaFRSbUxaNE5LcEhxWjNiMkU0NmVHUS9FK1c4dFFRK3lmUVYxTVhOdEk4VGlKdkhIY1hoS3BPZytBWApUcWNuM3hwVDR3YkpEZ0dtelcrVmgzNjg2YWJSRnVMbWtoZm96OVQ3WDJlcVFiYmliZHVudTFTTkJqZGV6bnJwCkJUTUh1L2NjRS9JK1VNYzJyTmlmUFNjMkFtYjd0SkdXZDBhckNJYnNNUmFlVGhPbTJUZUMySVMwY2pEQytoWGYKVHlRaDJOZHcyUitrajdqUVJnclByZVhPbDBmSUNabENERGNXTTRoVms0OHI5WGQ1OGtId2h2bHRjRTZpYlpnNgo1OVE9Ci0tLS0tRU5EIENFUlRJRklDQVRFIFJFUVVFU1QtLS0tLQo=",
          "signerName": "kubernetes.io/kube-apiserver-client",
          "expirationSeconds": 3600,
          "usages": [
            "client auth"
          ],
          "username": "kubernetes-admin",
          "groups": [
            "kubeadm:cluster-admins",
            "system:authenticated"
          ],
          "extra": {
            "authentication.kubernetes.io/credential-id": [
              "X509SHA256=3ffde68ef687218e01296d94b0aa59c81cc98de2bd73ab70e21510c8cd4b9cec"
            ]
          }
        },
        "status": {
          "conditions": [
            {
              "type": "Approved",
              "status": "True",
              "reason": "KubectlApprove",
              "message": "This CSR was approved by kubectl certificate approve.",
              "lastUpdateTime": "2026-07-02T23:16:14Z",
              "lastTransitionTime": "2026-07-02T23:16:14Z"
            }
          ],
          "certificate": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREekNDQWZlZ0F3SUJBZ0lSQU5HdHRjbWxZSzRuUks4TzdyclN1KzR3RFFZSktvWklodmNOQVFFTEJRQXcKRlRFVE1CRUdBMVVFQXhNS2EzVmlaWEp1WlhSbGN6QWVGdzB5TmpBM01ESXlNekV4TVRSYUZ3MHlOakEzTURNdwpNREUyTVRSYU1Da3hFREFPQmdOVkJBb1RCMlIzTFdoaGNtNHhGVEFUQmdOVkJBTVRER1IzTFdoaGNtNHRkWE5sCmNqQ0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCQUtNd2dJbGlQaHJ6SHJTNkFid2EKeVpJbWdEZmZ5RVlZb2U0L2dhY3RqRUc2dFRKUkhCM2lTY1pxQWR1c21PMDlEWVFiK0lCUnJ6dUNPMU53QXpXeQp3Z3Jxc3I0NC9CaVJWbDk3T1UzQ3dYZ2NVckJmRHlIR3BPZmNiMUZNaVA1OXZUUWl5VFpxeThralIwS1hxZlk3CnA2dW1DbkRkMVhJYWFmMHNlT0txMWZuck12YjRNNExhaXV1elptWjJObEhvVDRIdXlnMEFYeU1GL1ZBREZFcnEKa2kya21jREMrdUVoMC9lVFFvWW1NeW9LdC9YUEJtUEJLWDBSREhNSFBJQlo0cmxpODluMkVKcVdZVjU1Mm4rSgpCajVRWEw2S2ZRdXdod1Z0RGhjWHAvQmR3SURLQUx3NU04NzFVMGZxcG1PODRnL2dxZG1YYjR4YWUybURkOGtCCjhJOENBd0VBQWFOR01FUXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd0l3REFZRFZSMFRBUUgvQkFJd0FEQWYKQmdOVkhTTUVHREFXZ0JTNzdjUUJCT1psaEI1QklwNWM5b25YMEZvV3ZEQU5CZ2txaGtpRzl3MEJBUXNGQUFPQwpBUUVBS2VqdTF4Q1dMc1MweStGYXhPaTE2am9zMy9sdXM3ZXhPQ2JjcWUwbHUzUFdIamkwOXRUU0t1T21VaWhiCjBlNStJcExyKzl2T004NTllRVg1T3Z3c2hMTFZNeGlVOEs1b2JFN3ZuRUc3anB2RFJreUJldTZWVFI1bjlKMHgKeW83L25WRVRyWmV5QURWSHdjek1DWUtCYWQzZlNJY3FNbFhmZDl5MkFxYmZaaTZyZTRaNjMyU3F2RFBsalducQpla09GM0k1ZUI2WlRheUhKR1BLb2JJeW1uQTBJWmpYcnZGWnBKSVY1TW1pVjhjdUpRb2szZ2FYMFJlTVZraWtvCktJTWdBenRnazZ1cjAyNlRYMWFUTXRvRWdYMjFYVDVTS29CRHBQMXRaVnFjWG1VNFh0SFRaYTZUaVJJVXlPdzkKbWVDOWltUktBREhLbGl4TE8yN3hnNnh1RWc9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg=="
        }
      }
    ]
  },
  "requestReceivedTimestamp": "2026-07-02T23:16:14.559194Z",
  "stageTimestamp": "2026-07-02T23:16:14.563945Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

get certificatesigningrequests/approval

#
Resource
certificatesigningrequests

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/certificates.k8s.io/v1/certificatesigningrequests/dw-harn-csr-83be6c/approval",
  "verb": "get",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=97ca5ec05d5b7c1923d58d85f4449a4c26b2df61defa2a59b4045149ffed589e"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "certificatesigningrequests",
    "name": "dw-harn-csr-83be6c",
    "apiGroup": "certificates.k8s.io",
    "apiVersion": "v1",
    "subresource": "approval"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T22:49:23.643339Z",
  "stageTimestamp": "2026-07-02T22:49:23.644880Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

update certificatesigningrequests/approval

#
Resource
certificatesigningrequests

Description

CSR approval/denial (Kubernetes client-certificate privilege escalation path).

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/certificates.k8s.io/v1/certificatesigningrequests/dw-harn-csr-10e47a/approval",
  "verb": "update",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "certificatesigningrequests",
    "name": "dw-harn-csr-10e47a",
    "uid": "00000000-0000-0000-0000-000000000000",
    "apiGroup": "certificates.k8s.io",
    "apiVersion": "v1",
    "resourceVersion": "1857",
    "subresource": "approval"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {
    "kind": "CertificateSigningRequest",
    "apiVersion": "certificates.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-csr-10e47a",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1857",
      "creationTimestamp": "2026-07-02T04:49:00Z"
    },
    "spec": {
      "request": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURSBSRVFVRVNULS0tLS0KTUlJQ2JqQ0NBVllDQVFBd0tURVZNQk1HQTFVRUF3d01aSGN0YUdGeWJpMTFjMlZ5TVJBd0RnWURWUVFLREFkawpkeTFvWVhKdU1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBeFFQMHQwOHhVMGtVCnZqTXZJeGU4UDlzVjhkbkh4VkdHWFVxQjdJQzdGUnp0Nit1bDJVZEQzTmNrMU1aNGZuc3lNL241S09yUWNoN1gKOVJ0T29NVGhoVUJ6aksvR0cyTk1oT09JSjVEd25NWUFYWStIZm84RzVFN0pBbzJLWlNMZHo2UHZGWmYwa1o0Rgo1b01GajJSRTZrRWVlei94NTgrbkd6czBJZUZCNm1BU3V3Z3JHb1RyWUplcmZ5OVorUTMrcGRFb2VUdEYxWHpwCm5MOEJpTXkzNlBwc1duU1p3TDVYMFB3SElnZkc0ckZRcG00d1lDa2FuYWwyNXhZUXAwY3lyZWIrQmhMQU1hUG0KUE1XWnp5Q3NJcTNoR2gybmhJVGhMVUh0YjBVejRFQi9zdksxTnJ3YTU1SFlqUHE4VHBwbHlVZ1BTRXkxblhLWQora0ViQ1R5WTN3SURBUUFCb0FBd0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQkFFR2pBUHZndEdjWlNTc1JmRkU5Cjk2eWtVMlZub0owRWhINGo3aEIxYUZCdUE5akVRMVpRUnl4QnFuS2ZGQzRqK0toNUNjWXpTWWhNS3BadW90RC8KV3pXOTZqMDgyRHNpVFd6TTR3K1dhZUdmWEhRc3N6VHVlR3kzR0hwZG8yOW1xNGFOQU85SHhtODF4aXUyR000SApMUjllNVVDRSt4b0ZSVE16T21zbGJ1Y1NvRm5vMkUvcWZMbHhPQWY3WXg3TitFbFRDZ2hmR0dldjdjTXkwb0c0CnVXMlFwVk5vNDhneVpZMkFLZTVzQVZzYWgyWU1KY3VZeHM4bC9YT0RoeVlPaXZSZWRCWWorQ3A2WHkxWG04RFgKQ253cHE1RkExdnRSdmxwalY4aFpSN2FXTmZNNXRYNWVVM0JVKzhScXRWWnRZUFpxenVodFVTbVJ4SjlLVk0zVgpxbzQ9Ci0tLS0tRU5EIENFUlRJRklDQVRFIFJFUVVFU1QtLS0tLQo=",
      "signerName": "kubernetes.io/kube-apiserver-client",
      "expirationSeconds": 3600,
      "usages": [
        "client auth"
      ],
      "username": "kubernetes-admin",
      "groups": [
        "kubeadm:cluster-admins",
        "system:authenticated"
      ],
      "extra": {
        "authentication.kubernetes.io/credential-id": [
          "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
        ]
      }
    },
    "status": {
      "conditions": [
        {
          "type": "Approved",
          "status": "True",
          "reason": "KubectlApprove",
          "message": "This CSR was approved by kubectl certificate approve.",
          "lastUpdateTime": "2026-07-02T04:49:00Z",
          "lastTransitionTime": null
        }
      ]
    }
  },
  "responseObject": {
    "kind": "CertificateSigningRequest",
    "apiVersion": "certificates.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-csr-10e47a",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1858",
      "creationTimestamp": "2026-07-02T04:49:00Z"
    },
    "spec": {
      "request": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURSBSRVFVRVNULS0tLS0KTUlJQ2JqQ0NBVllDQVFBd0tURVZNQk1HQTFVRUF3d01aSGN0YUdGeWJpMTFjMlZ5TVJBd0RnWURWUVFLREFkawpkeTFvWVhKdU1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBeFFQMHQwOHhVMGtVCnZqTXZJeGU4UDlzVjhkbkh4VkdHWFVxQjdJQzdGUnp0Nit1bDJVZEQzTmNrMU1aNGZuc3lNL241S09yUWNoN1gKOVJ0T29NVGhoVUJ6aksvR0cyTk1oT09JSjVEd25NWUFYWStIZm84RzVFN0pBbzJLWlNMZHo2UHZGWmYwa1o0Rgo1b01GajJSRTZrRWVlei94NTgrbkd6czBJZUZCNm1BU3V3Z3JHb1RyWUplcmZ5OVorUTMrcGRFb2VUdEYxWHpwCm5MOEJpTXkzNlBwc1duU1p3TDVYMFB3SElnZkc0ckZRcG00d1lDa2FuYWwyNXhZUXAwY3lyZWIrQmhMQU1hUG0KUE1XWnp5Q3NJcTNoR2gybmhJVGhMVUh0YjBVejRFQi9zdksxTnJ3YTU1SFlqUHE4VHBwbHlVZ1BTRXkxblhLWQora0ViQ1R5WTN3SURBUUFCb0FBd0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQkFFR2pBUHZndEdjWlNTc1JmRkU5Cjk2eWtVMlZub0owRWhINGo3aEIxYUZCdUE5akVRMVpRUnl4QnFuS2ZGQzRqK0toNUNjWXpTWWhNS3BadW90RC8KV3pXOTZqMDgyRHNpVFd6TTR3K1dhZUdmWEhRc3N6VHVlR3kzR0hwZG8yOW1xNGFOQU85SHhtODF4aXUyR000SApMUjllNVVDRSt4b0ZSVE16T21zbGJ1Y1NvRm5vMkUvcWZMbHhPQWY3WXg3TitFbFRDZ2hmR0dldjdjTXkwb0c0CnVXMlFwVk5vNDhneVpZMkFLZTVzQVZzYWgyWU1KY3VZeHM4bC9YT0RoeVlPaXZSZWRCWWorQ3A2WHkxWG04RFgKQ253cHE1RkExdnRSdmxwalY4aFpSN2FXTmZNNXRYNWVVM0JVKzhScXRWWnRZUFpxenVodFVTbVJ4SjlLVk0zVgpxbzQ9Ci0tLS0tRU5EIENFUlRJRklDQVRFIFJFUVVFU1QtLS0tLQo=",
      "signerName": "kubernetes.io/kube-apiserver-client",
      "expirationSeconds": 3600,
      "usages": [
        "client auth"
      ],
      "username": "kubernetes-admin",
      "groups": [
        "kubeadm:cluster-admins",
        "system:authenticated"
      ],
      "extra": {
        "authentication.kubernetes.io/credential-id": [
          "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
        ]
      }
    },
    "status": {
      "conditions": [
        {
          "type": "Approved",
          "status": "True",
          "reason": "KubectlApprove",
          "message": "This CSR was approved by kubectl certificate approve.",
          "lastUpdateTime": "2026-07-02T04:49:00Z",
          "lastTransitionTime": "2026-07-02T04:49:00Z"
        }
      ]
    }
  },
  "requestReceivedTimestamp": "2026-07-02T04:49:00.240164Z",
  "stageTimestamp": "2026-07-02T04:49:00.244500Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
EventType (elastic rule field)inio.k8s.certificates.v1.certificatesigningrequests.approval.update2 ruleselastic
EventType (elastic rule field)inio.k8s.certificates.v1.certificatesigningrequests.create2 ruleselastic
azure.platformlogs.category (elastic rule field)inkube-audit1 ruleelastic
azure.platformlogs.category (elastic rule field)inkube-audit-admin1 ruleelastic
azure.platformlogs.properties.log.stage (elastic rule field)eqresponsecomplete1 ruleelastic
azure.platformlogs.properties.log.verb (elastic rule field)eqcreate1 ruleelastic
azure.platformlogs.properties.log.verb (elastic rule field)inpatch1 ruleelastic
azure.platformlogs.properties.log.verb (elastic rule field)inupdate1 ruleelastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • Azure AKS Certificate Signing Request Created or Approved source medium: Detects an identity creating a client-authentication CertificateSigningRequest (signer kubernetes.io/kube-apiserver-client) or approving a CSR on AKS (Azure Kubernetes Service), excluding node bootstrap and platform controllers. Adversaries submit and self-approve a CSR against the kube-apiserver-client signer to mint a long-lived client certificate for an arbitrary subject (for example a Common Name in system:masters), giving durable authenticated access that survives token revocation. Coverage includes workload service accounts (system:serviceaccount:*), so a compromised in-cluster token forging a certificate is not excluded.T1649↳ also matches create-certificatesigningrequests: create certificatesigningrequests, patch-certificatesigningrequests-approval: patch certificatesigningrequests/approval
    Investigation guide

    Triage and analysis#

    Investigating Azure AKS Certificate Signing Request Created or Approved#

    AKS kube-audit events are carried under the flattened azure.platformlogs.properties.log.* subtree and share the ARM operation event.action: Microsoft.ContainerService/managedClusters/diagnosticLogs/Read. A CSR created against the kubernetes.io/kube-apiserver-client signer lets the requester choose the certificate's subject (Common Name and organization/groups); once approved it mints a client certificate for an arbitrary identity that yields access not tied to a token. The default CertificateSubjectRestriction admission controller blocks requests for the system:masters group, so attackers commonly request a Common Name matching an existing privileged user (or another privileged group) instead, making the requested subject the key thing to decode. Node and kubelet certificates use the kube-apiserver-client-kubelet and kubelet-serving signers (whose subject is constrained to the node) and are out of scope; cert-manager and application CSRs use their own signers.

    Possible investigation steps#

    • Identify the requesting identity in azure.platformlogs.properties.log.user.username (and its groups in azure.platformlogs.properties.log.user.groups) and whether it should submit or approve CSRs. A workload service account (system:serviceaccount:<ns>:<sa>) or masterclient (the local cluster-admin cert) is the higher-concern case.
    • Confirm the signer in azure.platformlogs.properties.log.requestObject.spec.signerName and decode the base64 CSR in azure.platformlogs.properties.log.requestObject.spec.request to read the requested Common Name and organization (groups); a subject in system:masters or another privileged group is the escalation.
    • Determine whether the same or a related identity approved the CSR (verb:update/patch on the approval subresource), which indicates self-approval, and inspect azure.platformlogs.properties.log.userAgent.
    • Evaluate the source in azure.platformlogs.properties.log.sourceIPs and pivot on it for follow-on privileged API activity using the newly issued certificate.

    False positive analysis#

    • Node bootstrap (kube-apiserver-client-kubelet signer), kubelet-serving CSRs, and cert-manager/application CSRs (custom signers) are out of scope by design; the kube-controller-manager certificate-controller and the AKS aksService approver are excluded by identity.
    • Manual CSR approval by an administrator, or an operator that legitimately mints client certificates, may surface; baseline those identities and exclude the specific validated account rather than re-broadening to all system:*, which would blind the rule to compromised workload service accounts.

    Response and remediation#

    • If unauthorized, deny or delete the CSR, revoke the issued certificate, and rotate the cluster CA if a privileged certificate was minted.
    • Review the RBAC that allowed CSR creation and approval, and audit actions taken with the certificate.
    • Collect kube-audit and identity artifacts per incident response procedures.
  • GKE Certificate Signing Request Self-Approved source high: Detects when the same non-system GKE identity creates a CertificateSigningRequest (CSR) and then approves that same CSR within five minutes, consistent with self-approval abuse. Attackers who gain CSR create and approval RBAC can submit a certificate request and approve it themselves to obtain a long-lived client certificate without involving cluster operators, a pattern documented in Kubernetes persistence research and adversary emulation.T1098, T1098.006↳ also matches create-certificatesigningrequests: create certificatesigningrequests
    Investigation guide

    Triage and analysis#

    Investigating GKE Certificate Signing Request Self-Approved#

    This rule groups CSR create and approval events by client.user.email and normalized CSR name (Esql.csr_name). GKE logs approval on subresource paths (.../csr-name/approval), so the query strips /approval suffixes before correlating. An alert means the same identity both submitted and approved the same CSR within five minutes, a strong indicator of manual self-approval rather than normal system:gcp-controller-manager auto-approval of node certificates.

    Possible investigation steps#

    • Review Esql.event_action_values for the sequence of create followed by approval.update.
    • Inspect gcp.audit.request.spec.signerName and decode gcp.audit.request.spec.request on create events for the requested identity.
    • Validate whether the actor should hold both CSR create and approval permissions.
    • Hunt for subsequent API activity authenticated as the minted certificate identity.

    False positive analysis#

    • cert-manager or internal PKI automation that creates and approves CSRs under the same service account in one workflow.
    • GitOps or bootstrap tooling that submits and signs CSRs programmatically. Baseline known automation and tune exclusions for those principals.
    • Two unrelated CSR events from the same user within five minutes should not match because the query requires at least one create and one approval-class action on the same normalized CSR name.
    • GKE Certificate Signing Request API Client Signer Requested - 1e344fba-a2f7-462b-aaec-d6c8f80d5a28
    • GKE Certificate Signing Request Privileged Identity Requested - 4159bec9-76ad-4cdc-a797-4a8572073bbe
    • GKE Client Certificate Signing Request Created or Approved - ec67ab57-945a-4edb-84f8-1d7a51f46544

    Response and remediation#

    • Revoke or deny the CSR, remove approval RBAC from untrusted principals, and rotate cluster signing credentials if abuse is confirmed.
  • GKE Client Certificate Signing Request Created or Approved source medium: Detects creation or approval of a GKE CertificateSigningRequest (CSR) by a non-system identity. This is a breadth baseline rule for human or custom automation CSR activity on GKE. Attackers with cluster access can submit and approve CSRs to obtain long-lived client certificates that survive token revocation and RBAC changes. Use companion rules to evaluate signer choice, requested identity, and self-approval behavior.T1098, T1098.006↳ also matches create-certificatesigningrequests: create certificatesigningrequests
    Investigation guide

    Triage and analysis#

    Investigating GKE Client Certificate Signing Request Created or Approved#

    Identify the actor (client.user.email), source.ip, and user_agent.original. Confirm whether the principal is expected to create or approve CSRs. Review event.action, gcp.audit.resource_name, and when audit level captures request bodies, the CSR spec in gcp.audit.request (requested signer, usages, and requested identity / Common Name).

    Extracting the Certificate Common Name#

    For create events, gcp.audit.request.spec.request may hold the base64-encoded PEM certificate signing request. On GKE this is base64 of the full PEM CSR. Decode and inspect the subject for high-risk Common Names such as system:masters, system:kube-controller-manager, and system:admin. The companion rule "GKE Certificate Signing Request Privileged Identity Requested" decodes the CSR body and matches those identities automatically.

    # Full decoded PEM block
echo "<gcp.audit.request.spec.request>" | base64 -d

# Parsed CSR details (subject, key type/size, extensions, signature)
echo "<gcp.audit.request.spec.request>" | base64 -d | openssl req -noout -text

# Subject only
echo "<gcp.audit.request.spec.request>" | base64 -d | openssl req -noout -subject

    Priority CNs that usually indicate privilege escalation intent:

    • system:masters (cluster-admin group)
    • system:kube-controller-manager (broad control-plane-style access, including secrets and token minting)
    • system:kube-scheduler (scheduling across the cluster)
    • system:kube-proxy (node/network-adjacent access)
    • Any CN that matches an existing ClusterRoleBinding subject name

    Possible investigation steps#

    • Compare the CSR name and extracted CN against approved PKI or bootstrap processes.
    • Determine whether the same identity both created and approved the CSR in a short window (approval.update, update, or patch), which matches self-approval abuse.
    • Review gcp.audit.resource_name and subsequent authentication or API activity from unusual networks.
    • Correlate with RBAC changes, secret access, or TokenRequest activity that preceded CSR activity.

    False positive analysis#

    • Admins testing CSR workflows with kubectl are common in lab clusters. Baseline expected operators and tune exclusions.
    • cert-manager or custom PKI automation outside the exclusion list may create or approve CSRs during normal rotation.
    • GKE Certificate Signing Request API Client Signer Requested - 1e344fba-a2f7-462b-aaec-d6c8f80d5a28
    • GKE Certificate Signing Request Privileged Identity Requested - 4159bec9-76ad-4cdc-a797-4a8572073bbe
    • GKE Certificate Signing Request Self-Approved - e155e658-3dcd-4d27-a4e5-1d8da6704b0e

    Response and remediation#

    • If malicious, deny further approval, delete or deny the CSR per incident policy, revoke or rotate cluster signing trust if the CA or signer was abused, and invalidate issued credentials.
    • Remove excessive RBAC that allows certificatesigningrequests create/update/patch or approval for untrusted identities; enforce signer restrictions and approved issuers where supported.

References #

patch certificatesigningrequests/approval

#
Resource
certificatesigningrequests

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
azure.platformlogs.category (elastic rule field)inkube-audit1 ruleelastic
azure.platformlogs.category (elastic rule field)inkube-audit-admin1 ruleelastic
azure.platformlogs.properties.log.stage (elastic rule field)eqresponsecomplete1 ruleelastic
azure.platformlogs.properties.log.verb (elastic rule field)eqcreate1 ruleelastic
azure.platformlogs.properties.log.verb (elastic rule field)inpatch1 ruleelastic
azure.platformlogs.properties.log.verb (elastic rule field)inupdate1 ruleelastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

get certificatesigningrequests/status

#
Resource
certificatesigningrequests

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/certificates.k8s.io/v1/certificatesigningrequests/dw-harn-csr-83be6c/status",
  "verb": "get",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=97ca5ec05d5b7c1923d58d85f4449a4c26b2df61defa2a59b4045149ffed589e"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "certificatesigningrequests",
    "name": "dw-harn-csr-83be6c",
    "apiGroup": "certificates.k8s.io",
    "apiVersion": "v1",
    "subresource": "status"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T22:49:23.784065Z",
  "stageTimestamp": "2026-07-02T22:49:23.785395Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

update certificatesigningrequests/status

#
Resource
certificatesigningrequests

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/certificates.k8s.io/v1/certificatesigningrequests/dw-harn-csr-83be6c/status?fieldManager=kubectl-replace&fieldValidation=Strict",
  "verb": "update",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=97ca5ec05d5b7c1923d58d85f4449a4c26b2df61defa2a59b4045149ffed589e"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "certificatesigningrequests",
    "name": "dw-harn-csr-83be6c",
    "uid": "00000000-0000-0000-0000-000000000000",
    "apiGroup": "certificates.k8s.io",
    "apiVersion": "v1",
    "resourceVersion": "1478",
    "subresource": "status"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {
    "kind": "CertificateSigningRequest",
    "apiVersion": "certificates.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-csr-83be6c",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1478",
      "creationTimestamp": "2026-07-02T22:49:20Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "request": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURSBSRVFVRVNULS0tLS0KTUlJQ2JqQ0NBVllDQVFBd0tURVZNQk1HQTFVRUF3d01aSGN0YUdGeWJpMTFjMlZ5TVJBd0RnWURWUVFLREFkawpkeTFvWVhKdU1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBM0EzMzdTdmY5a3RKCmxzeUhZWG5zcXRtWGp5dC9CSGQ2cGNGY1RNN3UyZ1lFK2JodlVjTnR0c3N3M3ptMFpFQ0Z6SC9SUFo1VE8yamIKV2hKaytORXFuTlYvVjVxaEV3clM5TVNhNVdzRnVTWFc2Mms2VkVtdHEwV3VpMlZsd1lrK0g2b05LRVJVYkVWVwpLN0tBaTY4MkRHV2ZJT1hZSjNrVExxT0laSlBRcnFhNVNtSEx0NVR1dkpKSDEvTzgrelF1NUxXNGpLK3lOWnB0ClZRM3hjQmJTM2hUTGpPTWpxQXZDY3VsN2pwMjNQRTFHQzN5cjRCbVZoUVJibFg5dTRqeTlkRFpzSEF6UG1BRnMKTE83RHk0ZDREcitaSFF6UU56bnluNWFkNWVyeXN4cnJ1dlJ1VTYwK1Qza1AvUlp0SjFmNnJDcnFubWx6N3NqWQpyZ0RNQ3RRUnhRSURBUUFCb0FBd0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQkFNb0dEbW5zU3V4MUE1SE5QcG90CkIyNWZJc3dvNVNwRkxjaDFDa2V6cm45UmxNS2Q0b3NvczlFRUR3SUxKSHlwdEVxU2pnRlpMR0FWZGM1Nks3ckkKaVhKbUFISDBxZ3Q1ZUR0eG9sU1J2R2pQUVQrbW1NZ0RJRS9MNW9FMkROQ3d2T2NraUYzWGM1YktZczBkV2FpUApOOFlzeDdrNmRQRDdQdENESkt2VTM1eEp3NlJTZmpUczVQdTZMbEh5UFpkZy81UG5OUzZCNFZkWS9CNUpMa3N6Ck1hZDRLbDE3YU9WUE1wQThoaklmZHZWNHhWMTJ3VkF0WUJ6T3p3WngwZTFTeW96VWE0c1RZQWs0eUxlV0Fzbm0KNStheXhDbjRMQkVSaVBCUVZ5OEE0SWtuS2ppZFd2MFVrcHM5NkVUS2w0M2YweEdOYWk3MlllcDZVbDgxRkhTdgo3aW89Ci0tLS0tRU5EIENFUlRJRklDQVRFIFJFUVVFU1QtLS0tLQo=",
      "signerName": "kubernetes.io/kube-apiserver-client",
      "expirationSeconds": 3600,
      "usages": [
        "client auth"
      ],
      "username": "kubernetes-admin",
      "groups": [
        "kubeadm:cluster-admins",
        "system:authenticated"
      ],
      "extra": {
        "authentication.kubernetes.io/credential-id": [
          "X509SHA256=97ca5ec05d5b7c1923d58d85f4449a4c26b2df61defa2a59b4045149ffed589e"
        ]
      }
    },
    "status": {
      "conditions": [
        {
          "type": "Approved",
          "status": "True",
          "reason": "KubectlApprove",
          "message": "This CSR was approved by kubectl certificate approve.",
          "lastUpdateTime": "2026-07-02T22:49:23Z",
          "lastTransitionTime": "2026-07-02T22:49:23Z"
        }
      ],
      "certificate": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREakNDQWZhZ0F3SUJBZ0lRQWV2WURuYXdVM2hidFNaS3hkTzhYREFOQmdrcWhraUc5dzBCQVFzRkFEQVYKTVJNd0VRWURWUVFERXdwcmRXSmxjbTVsZEdWek1CNFhEVEkyTURjd01qSXlORFF5TTFvWERUSTJNRGN3TWpJegpORGt5TTFvd0tURVFNQTRHQTFVRUNoTUhaSGN0YUdGeWJqRVZNQk1HQTFVRUF4TU1aSGN0YUdGeWJpMTFjMlZ5Ck1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBM0EzMzdTdmY5a3RKbHN5SFlYbnMKcXRtWGp5dC9CSGQ2cGNGY1RNN3UyZ1lFK2JodlVjTnR0c3N3M3ptMFpFQ0Z6SC9SUFo1VE8yamJXaEprK05FcQpuTlYvVjVxaEV3clM5TVNhNVdzRnVTWFc2Mms2VkVtdHEwV3VpMlZsd1lrK0g2b05LRVJVYkVWV0s3S0FpNjgyCkRHV2ZJT1hZSjNrVExxT0laSlBRcnFhNVNtSEx0NVR1dkpKSDEvTzgrelF1NUxXNGpLK3lOWnB0VlEzeGNCYlMKM2hUTGpPTWpxQXZDY3VsN2pwMjNQRTFHQzN5cjRCbVZoUVJibFg5dTRqeTlkRFpzSEF6UG1BRnNMTzdEeTRkNApEcitaSFF6UU56bnluNWFkNWVyeXN4cnJ1dlJ1VTYwK1Qza1AvUlp0SjFmNnJDcnFubWx6N3NqWXJnRE1DdFFSCnhRSURBUUFCbzBZd1JEQVRCZ05WSFNVRUREQUtCZ2dyQmdFRkJRY0RBakFNQmdOVkhSTUJBZjhFQWpBQU1COEcKQTFVZEl3UVlNQmFBRkoweFQ1eldESlY4MW82a3J1YkpTbWM1RDZ2aE1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQgpBUUI2RHNjakdDRDltWFN2QVQwdWt1L1B1RlRqVGNucjdHLyt3a0RvR1FxVzcwOE12NUVCNVlMSUdKa2FObCt5CnFPdm84Yk9RMFR6OUFnQWNBNzFGOEtZZ0lndEVxaDJuUmpueFFjMWd5SVNLV0FaaWFGa0FML2pLQ2VkbHFFbUwKWVp6WHZIaHlMdUNLS0hCSDgxNStzclJKZGpvMk9PQjU3SkpjbzJsUk9BZE5wOCt1SG1SajVQTHNRU01tbTdYagpXWERwKzZRdGlTZzFWQm13ZDhkOWNmeTVWZWlxbFFFdXlVdkZRODZyL0VqS0MvK3M0UUM1Wmk5dnJ6RThZSG83CjR0ZVN4aTFQaWZOZThWNHRHZ3Mzb3VGczgwWVBMYWlES09ocE0yOThHaFJGRWxMdTF1bUtQRDZldGljRVRDYVQKbHpaYlRSNDlXV3BRcGY2dDZGc2x2aFg4Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K"
    }
  },
  "responseObject": {
    "kind": "CertificateSigningRequest",
    "apiVersion": "certificates.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-csr-83be6c",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1478",
      "creationTimestamp": "2026-07-02T22:49:20Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "request": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURSBSRVFVRVNULS0tLS0KTUlJQ2JqQ0NBVllDQVFBd0tURVZNQk1HQTFVRUF3d01aSGN0YUdGeWJpMTFjMlZ5TVJBd0RnWURWUVFLREFkawpkeTFvWVhKdU1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBM0EzMzdTdmY5a3RKCmxzeUhZWG5zcXRtWGp5dC9CSGQ2cGNGY1RNN3UyZ1lFK2JodlVjTnR0c3N3M3ptMFpFQ0Z6SC9SUFo1VE8yamIKV2hKaytORXFuTlYvVjVxaEV3clM5TVNhNVdzRnVTWFc2Mms2VkVtdHEwV3VpMlZsd1lrK0g2b05LRVJVYkVWVwpLN0tBaTY4MkRHV2ZJT1hZSjNrVExxT0laSlBRcnFhNVNtSEx0NVR1dkpKSDEvTzgrelF1NUxXNGpLK3lOWnB0ClZRM3hjQmJTM2hUTGpPTWpxQXZDY3VsN2pwMjNQRTFHQzN5cjRCbVZoUVJibFg5dTRqeTlkRFpzSEF6UG1BRnMKTE83RHk0ZDREcitaSFF6UU56bnluNWFkNWVyeXN4cnJ1dlJ1VTYwK1Qza1AvUlp0SjFmNnJDcnFubWx6N3NqWQpyZ0RNQ3RRUnhRSURBUUFCb0FBd0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQkFNb0dEbW5zU3V4MUE1SE5QcG90CkIyNWZJc3dvNVNwRkxjaDFDa2V6cm45UmxNS2Q0b3NvczlFRUR3SUxKSHlwdEVxU2pnRlpMR0FWZGM1Nks3ckkKaVhKbUFISDBxZ3Q1ZUR0eG9sU1J2R2pQUVQrbW1NZ0RJRS9MNW9FMkROQ3d2T2NraUYzWGM1YktZczBkV2FpUApOOFlzeDdrNmRQRDdQdENESkt2VTM1eEp3NlJTZmpUczVQdTZMbEh5UFpkZy81UG5OUzZCNFZkWS9CNUpMa3N6Ck1hZDRLbDE3YU9WUE1wQThoaklmZHZWNHhWMTJ3VkF0WUJ6T3p3WngwZTFTeW96VWE0c1RZQWs0eUxlV0Fzbm0KNStheXhDbjRMQkVSaVBCUVZ5OEE0SWtuS2ppZFd2MFVrcHM5NkVUS2w0M2YweEdOYWk3MlllcDZVbDgxRkhTdgo3aW89Ci0tLS0tRU5EIENFUlRJRklDQVRFIFJFUVVFU1QtLS0tLQo=",
      "signerName": "kubernetes.io/kube-apiserver-client",
      "expirationSeconds": 3600,
      "usages": [
        "client auth"
      ],
      "username": "kubernetes-admin",
      "groups": [
        "kubeadm:cluster-admins",
        "system:authenticated"
      ],
      "extra": {
        "authentication.kubernetes.io/credential-id": [
          "X509SHA256=97ca5ec05d5b7c1923d58d85f4449a4c26b2df61defa2a59b4045149ffed589e"
        ]
      }
    },
    "status": {
      "conditions": [
        {
          "type": "Approved",
          "status": "True",
          "reason": "KubectlApprove",
          "message": "This CSR was approved by kubectl certificate approve.",
          "lastUpdateTime": "2026-07-02T22:49:23Z",
          "lastTransitionTime": "2026-07-02T22:49:23Z"
        }
      ],
      "certificate": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREakNDQWZhZ0F3SUJBZ0lRQWV2WURuYXdVM2hidFNaS3hkTzhYREFOQmdrcWhraUc5dzBCQVFzRkFEQVYKTVJNd0VRWURWUVFERXdwcmRXSmxjbTVsZEdWek1CNFhEVEkyTURjd01qSXlORFF5TTFvWERUSTJNRGN3TWpJegpORGt5TTFvd0tURVFNQTRHQTFVRUNoTUhaSGN0YUdGeWJqRVZNQk1HQTFVRUF4TU1aSGN0YUdGeWJpMTFjMlZ5Ck1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBM0EzMzdTdmY5a3RKbHN5SFlYbnMKcXRtWGp5dC9CSGQ2cGNGY1RNN3UyZ1lFK2JodlVjTnR0c3N3M3ptMFpFQ0Z6SC9SUFo1VE8yamJXaEprK05FcQpuTlYvVjVxaEV3clM5TVNhNVdzRnVTWFc2Mms2VkVtdHEwV3VpMlZsd1lrK0g2b05LRVJVYkVWV0s3S0FpNjgyCkRHV2ZJT1hZSjNrVExxT0laSlBRcnFhNVNtSEx0NVR1dkpKSDEvTzgrelF1NUxXNGpLK3lOWnB0VlEzeGNCYlMKM2hUTGpPTWpxQXZDY3VsN2pwMjNQRTFHQzN5cjRCbVZoUVJibFg5dTRqeTlkRFpzSEF6UG1BRnNMTzdEeTRkNApEcitaSFF6UU56bnluNWFkNWVyeXN4cnJ1dlJ1VTYwK1Qza1AvUlp0SjFmNnJDcnFubWx6N3NqWXJnRE1DdFFSCnhRSURBUUFCbzBZd1JEQVRCZ05WSFNVRUREQUtCZ2dyQmdFRkJRY0RBakFNQmdOVkhSTUJBZjhFQWpBQU1COEcKQTFVZEl3UVlNQmFBRkoweFQ1eldESlY4MW82a3J1YkpTbWM1RDZ2aE1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQgpBUUI2RHNjakdDRDltWFN2QVQwdWt1L1B1RlRqVGNucjdHLyt3a0RvR1FxVzcwOE12NUVCNVlMSUdKa2FObCt5CnFPdm84Yk9RMFR6OUFnQWNBNzFGOEtZZ0lndEVxaDJuUmpueFFjMWd5SVNLV0FaaWFGa0FML2pLQ2VkbHFFbUwKWVp6WHZIaHlMdUNLS0hCSDgxNStzclJKZGpvMk9PQjU3SkpjbzJsUk9BZE5wOCt1SG1SajVQTHNRU01tbTdYagpXWERwKzZRdGlTZzFWQm13ZDhkOWNmeTVWZWlxbFFFdXlVdkZRODZyL0VqS0MvK3M0UUM1Wmk5dnJ6RThZSG83CjR0ZVN4aTFQaWZOZThWNHRHZ3Mzb3VGczgwWVBMYWlES09ocE0yOThHaFJGRWxMdTF1bUtQRDZldGljRVRDYVQKbHpaYlRSNDlXV3BRcGY2dDZGc2x2aFg4Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K"
    }
  },
  "requestReceivedTimestamp": "2026-07-02T22:49:23.857184Z",
  "stageTimestamp": "2026-07-02T22:49:23.859549Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

patch certificatesigningrequests/status

#
Resource
certificatesigningrequests

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/certificates.k8s.io/v1/certificatesigningrequests/dw-harn-csr-83be6c/status?fieldManager=kubectl-patch",
  "verb": "patch",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=97ca5ec05d5b7c1923d58d85f4449a4c26b2df61defa2a59b4045149ffed589e"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "certificatesigningrequests",
    "name": "dw-harn-csr-83be6c",
    "apiGroup": "certificates.k8s.io",
    "apiVersion": "v1",
    "subresource": "status"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {},
  "responseObject": {
    "kind": "CertificateSigningRequest",
    "apiVersion": "certificates.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-csr-83be6c",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1478",
      "creationTimestamp": "2026-07-02T22:49:20Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "request": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURSBSRVFVRVNULS0tLS0KTUlJQ2JqQ0NBVllDQVFBd0tURVZNQk1HQTFVRUF3d01aSGN0YUdGeWJpMTFjMlZ5TVJBd0RnWURWUVFLREFkawpkeTFvWVhKdU1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBM0EzMzdTdmY5a3RKCmxzeUhZWG5zcXRtWGp5dC9CSGQ2cGNGY1RNN3UyZ1lFK2JodlVjTnR0c3N3M3ptMFpFQ0Z6SC9SUFo1VE8yamIKV2hKaytORXFuTlYvVjVxaEV3clM5TVNhNVdzRnVTWFc2Mms2VkVtdHEwV3VpMlZsd1lrK0g2b05LRVJVYkVWVwpLN0tBaTY4MkRHV2ZJT1hZSjNrVExxT0laSlBRcnFhNVNtSEx0NVR1dkpKSDEvTzgrelF1NUxXNGpLK3lOWnB0ClZRM3hjQmJTM2hUTGpPTWpxQXZDY3VsN2pwMjNQRTFHQzN5cjRCbVZoUVJibFg5dTRqeTlkRFpzSEF6UG1BRnMKTE83RHk0ZDREcitaSFF6UU56bnluNWFkNWVyeXN4cnJ1dlJ1VTYwK1Qza1AvUlp0SjFmNnJDcnFubWx6N3NqWQpyZ0RNQ3RRUnhRSURBUUFCb0FBd0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQkFNb0dEbW5zU3V4MUE1SE5QcG90CkIyNWZJc3dvNVNwRkxjaDFDa2V6cm45UmxNS2Q0b3NvczlFRUR3SUxKSHlwdEVxU2pnRlpMR0FWZGM1Nks3ckkKaVhKbUFISDBxZ3Q1ZUR0eG9sU1J2R2pQUVQrbW1NZ0RJRS9MNW9FMkROQ3d2T2NraUYzWGM1YktZczBkV2FpUApOOFlzeDdrNmRQRDdQdENESkt2VTM1eEp3NlJTZmpUczVQdTZMbEh5UFpkZy81UG5OUzZCNFZkWS9CNUpMa3N6Ck1hZDRLbDE3YU9WUE1wQThoaklmZHZWNHhWMTJ3VkF0WUJ6T3p3WngwZTFTeW96VWE0c1RZQWs0eUxlV0Fzbm0KNStheXhDbjRMQkVSaVBCUVZ5OEE0SWtuS2ppZFd2MFVrcHM5NkVUS2w0M2YweEdOYWk3MlllcDZVbDgxRkhTdgo3aW89Ci0tLS0tRU5EIENFUlRJRklDQVRFIFJFUVVFU1QtLS0tLQo=",
      "signerName": "kubernetes.io/kube-apiserver-client",
      "expirationSeconds": 3600,
      "usages": [
        "client auth"
      ],
      "username": "kubernetes-admin",
      "groups": [
        "kubeadm:cluster-admins",
        "system:authenticated"
      ],
      "extra": {
        "authentication.kubernetes.io/credential-id": [
          "X509SHA256=97ca5ec05d5b7c1923d58d85f4449a4c26b2df61defa2a59b4045149ffed589e"
        ]
      }
    },
    "status": {
      "conditions": [
        {
          "type": "Approved",
          "status": "True",
          "reason": "KubectlApprove",
          "message": "This CSR was approved by kubectl certificate approve.",
          "lastUpdateTime": "2026-07-02T22:49:23Z",
          "lastTransitionTime": "2026-07-02T22:49:23Z"
        }
      ],
      "certificate": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREakNDQWZhZ0F3SUJBZ0lRQWV2WURuYXdVM2hidFNaS3hkTzhYREFOQmdrcWhraUc5dzBCQVFzRkFEQVYKTVJNd0VRWURWUVFERXdwcmRXSmxjbTVsZEdWek1CNFhEVEkyTURjd01qSXlORFF5TTFvWERUSTJNRGN3TWpJegpORGt5TTFvd0tURVFNQTRHQTFVRUNoTUhaSGN0YUdGeWJqRVZNQk1HQTFVRUF4TU1aSGN0YUdGeWJpMTFjMlZ5Ck1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBM0EzMzdTdmY5a3RKbHN5SFlYbnMKcXRtWGp5dC9CSGQ2cGNGY1RNN3UyZ1lFK2JodlVjTnR0c3N3M3ptMFpFQ0Z6SC9SUFo1VE8yamJXaEprK05FcQpuTlYvVjVxaEV3clM5TVNhNVdzRnVTWFc2Mms2VkVtdHEwV3VpMlZsd1lrK0g2b05LRVJVYkVWV0s3S0FpNjgyCkRHV2ZJT1hZSjNrVExxT0laSlBRcnFhNVNtSEx0NVR1dkpKSDEvTzgrelF1NUxXNGpLK3lOWnB0VlEzeGNCYlMKM2hUTGpPTWpxQXZDY3VsN2pwMjNQRTFHQzN5cjRCbVZoUVJibFg5dTRqeTlkRFpzSEF6UG1BRnNMTzdEeTRkNApEcitaSFF6UU56bnluNWFkNWVyeXN4cnJ1dlJ1VTYwK1Qza1AvUlp0SjFmNnJDcnFubWx6N3NqWXJnRE1DdFFSCnhRSURBUUFCbzBZd1JEQVRCZ05WSFNVRUREQUtCZ2dyQmdFRkJRY0RBakFNQmdOVkhSTUJBZjhFQWpBQU1COEcKQTFVZEl3UVlNQmFBRkoweFQ1eldESlY4MW82a3J1YkpTbWM1RDZ2aE1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQgpBUUI2RHNjakdDRDltWFN2QVQwdWt1L1B1RlRqVGNucjdHLyt3a0RvR1FxVzcwOE12NUVCNVlMSUdKa2FObCt5CnFPdm84Yk9RMFR6OUFnQWNBNzFGOEtZZ0lndEVxaDJuUmpueFFjMWd5SVNLV0FaaWFGa0FML2pLQ2VkbHFFbUwKWVp6WHZIaHlMdUNLS0hCSDgxNStzclJKZGpvMk9PQjU3SkpjbzJsUk9BZE5wOCt1SG1SajVQTHNRU01tbTdYagpXWERwKzZRdGlTZzFWQm13ZDhkOWNmeTVWZWlxbFFFdXlVdkZRODZyL0VqS0MvK3M0UUM1Wmk5dnJ6RThZSG83CjR0ZVN4aTFQaWZOZThWNHRHZ3Mzb3VGczgwWVBMYWlES09ocE0yOThHaFJGRWxMdTF1bUtQRDZldGljRVRDYVQKbHpaYlRSNDlXV3BRcGY2dDZGc2x2aFg4Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K"
    }
  },
  "requestReceivedTimestamp": "2026-07-02T22:49:23.927841Z",
  "stageTimestamp": "2026-07-02T22:49:23.930293Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

any verb on certificatesigningrequests (synthetic aggregation)

#
Resource
certificatesigningrequests

Description

Synthetic aggregation for rules that filter the certificatesigningrequests resource with no specific verb. Not a distinct audit record; hosts rule listings that key on objectRef.resource alone.