detection.wiki

CSIDrivers

OperationDescriptionSampleRule
get-csidriversReads a single CSIDriver, the cluster-wide registration of a storage plugin. Elastic's new-terms user-agent rule alerts on a not-previously-seen identity reading it.YN
list-csidriversLists registered CSI storage drivers, mapping which storage plugins (and their attach/mount privileges) are active. Elastic's new-terms rule covers this too.YN
watch-csidriversOpens a long-lived watch on CSIDriver changes. Elastic's new-terms rule alerts on a not-previously-seen identity watching this storage config.YN
create-csidriversYN
update-csidriversYN
patch-csidriversModifies a CSIDriver's capabilities (e.g. attachRequired, podInfoOnMount). An unexpected change here alters how every pod using that driver mounts volumes.YN
delete-csidriversYN
deletecollection-csidriversYN
any-csidriversSynthetic aggregation for rules that filter the csidrivers resource with no specific verb. Not a distinct audit record; hosts rule listings that key on objectRef.resource alone.NY

get csidrivers

#
Resource
csidrivers

Description

Reads a single CSIDriver, the cluster-wide registration of a storage plugin. Elastic's new-terms user-agent rule alerts on a not-previously-seen identity reading it.

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/storage.k8s.io/v1/csidrivers/dw-harn-csidrivers",
  "verb": "get",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=4cf95d11cbd90036bab41cdc6b88cc8f91550e9135ed4bb61495b02f647812ff"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "csidrivers",
    "name": "dw-harn-csidrivers",
    "apiGroup": "storage.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T21:32:28.936364Z",
  "stageTimestamp": "2026-07-02T21:32:28.938593Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

list csidrivers

#
Resource
csidrivers

Description

Lists registered CSI storage drivers, mapping which storage plugins (and their attach/mount privileges) are active. Elastic's new-terms rule covers this too.

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/storage.k8s.io/v1/csidrivers?labelSelector=dw-harn-patched%3D1",
  "verb": "list",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=fd038e49e5a46840f8f58360c3f09257f92bccd0cadad3ad68fcfec20b99b52c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "csidrivers",
    "apiGroup": "storage.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T22:13:46.285301Z",
  "stageTimestamp": "2026-07-02T22:13:46.286804Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

watch csidrivers

#
Resource
csidrivers

Description

Opens a long-lived watch on CSIDriver changes. Elastic's new-terms rule alerts on a not-previously-seen identity watching this storage config.

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/storage.k8s.io/v1/csidrivers?resourceVersion=1019&timeout=3s&watch=true",
  "verb": "watch",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=fd038e49e5a46840f8f58360c3f09257f92bccd0cadad3ad68fcfec20b99b52c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "csidrivers",
    "apiGroup": "storage.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T22:13:42.889714Z",
  "stageTimestamp": "2026-07-02T22:13:45.904350Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

create csidrivers

#
Resource
csidrivers

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/storage.k8s.io/v1/csidrivers?fieldManager=kubectl-create&fieldValidation=Strict",
  "verb": "create",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=4cf95d11cbd90036bab41cdc6b88cc8f91550e9135ed4bb61495b02f647812ff"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "csidrivers",
    "name": "dw-harn-csidrivers",
    "apiGroup": "storage.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 201
  },
  "requestObject": {
    "kind": "CSIDriver",
    "apiVersion": "storage.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-csidrivers"
    },
    "spec": {
      "attachRequired": false,
      "podInfoOnMount": false,
      "volumeLifecycleModes": [
        "Persistent"
      ],
      "storageCapacity": false,
      "fsGroupPolicy": "ReadWriteOnceWithFSType",
      "requiresRepublish": false,
      "seLinuxMount": false
    }
  },
  "responseObject": {
    "kind": "CSIDriver",
    "apiVersion": "storage.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-csidrivers",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "954",
      "creationTimestamp": "2026-07-02T21:32:28Z"
    },
    "spec": {
      "attachRequired": false,
      "podInfoOnMount": false,
      "volumeLifecycleModes": [
        "Persistent"
      ],
      "storageCapacity": false,
      "fsGroupPolicy": "ReadWriteOnceWithFSType",
      "requiresRepublish": false,
      "seLinuxMount": false
    }
  },
  "requestReceivedTimestamp": "2026-07-02T21:32:28.861940Z",
  "stageTimestamp": "2026-07-02T21:32:28.865717Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

update csidrivers

#
Resource
csidrivers

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/storage.k8s.io/v1/csidrivers/dw-harn-csidrivers?fieldManager=kubectl-replace&fieldValidation=Strict",
  "verb": "update",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=4cf95d11cbd90036bab41cdc6b88cc8f91550e9135ed4bb61495b02f647812ff"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "csidrivers",
    "name": "dw-harn-csidrivers",
    "uid": "00000000-0000-0000-0000-000000000000",
    "apiGroup": "storage.k8s.io",
    "apiVersion": "v1",
    "resourceVersion": "960"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {
    "kind": "CSIDriver",
    "apiVersion": "storage.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-csidrivers",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "960",
      "creationTimestamp": "2026-07-02T21:32:28Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "attachRequired": false,
      "podInfoOnMount": false,
      "volumeLifecycleModes": [
        "Persistent"
      ],
      "storageCapacity": false,
      "fsGroupPolicy": "ReadWriteOnceWithFSType",
      "requiresRepublish": false,
      "seLinuxMount": false
    }
  },
  "responseObject": {
    "kind": "CSIDriver",
    "apiVersion": "storage.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-csidrivers",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "960",
      "creationTimestamp": "2026-07-02T21:32:28Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "attachRequired": false,
      "podInfoOnMount": false,
      "volumeLifecycleModes": [
        "Persistent"
      ],
      "storageCapacity": false,
      "fsGroupPolicy": "ReadWriteOnceWithFSType",
      "requiresRepublish": false,
      "seLinuxMount": false
    }
  },
  "requestReceivedTimestamp": "2026-07-02T21:32:32.318517Z",
  "stageTimestamp": "2026-07-02T21:32:32.321264Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

patch csidrivers

#
Resource
csidrivers

Description

Modifies a CSIDriver's capabilities (e.g. attachRequired, podInfoOnMount). An unexpected change here alters how every pod using that driver mounts volumes.

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/storage.k8s.io/v1/csidrivers/dw-harn-csidrivers?fieldManager=kubectl-patch",
  "verb": "patch",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=4cf95d11cbd90036bab41cdc6b88cc8f91550e9135ed4bb61495b02f647812ff"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "csidrivers",
    "name": "dw-harn-csidrivers",
    "apiGroup": "storage.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {
    "metadata": {
      "labels": {
        "dw-harn-patched": "1"
      }
    }
  },
  "responseObject": {
    "kind": "CSIDriver",
    "apiVersion": "storage.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-csidrivers",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "960",
      "creationTimestamp": "2026-07-02T21:32:28Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "attachRequired": false,
      "podInfoOnMount": false,
      "volumeLifecycleModes": [
        "Persistent"
      ],
      "storageCapacity": false,
      "fsGroupPolicy": "ReadWriteOnceWithFSType",
      "requiresRepublish": false,
      "seLinuxMount": false
    }
  },
  "requestReceivedTimestamp": "2026-07-02T21:32:32.160733Z",
  "stageTimestamp": "2026-07-02T21:32:32.164761Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

delete csidrivers

#
Resource
csidrivers

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/storage.k8s.io/v1/csidrivers/dw-harn-csidrivers",
  "verb": "delete",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=4cf95d11cbd90036bab41cdc6b88cc8f91550e9135ed4bb61495b02f647812ff"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "csidrivers",
    "name": "dw-harn-csidrivers",
    "apiGroup": "storage.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {
    "kind": "DeleteOptions",
    "apiVersion": "meta.k8s.io/__internal",
    "propagationPolicy": "Background"
  },
  "responseObject": {
    "kind": "CSIDriver",
    "apiVersion": "storage.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-csidrivers",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "961",
      "creationTimestamp": "2026-07-02T21:32:28Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "attachRequired": false,
      "podInfoOnMount": false,
      "volumeLifecycleModes": [
        "Persistent"
      ],
      "storageCapacity": false,
      "fsGroupPolicy": "ReadWriteOnceWithFSType",
      "requiresRepublish": false,
      "seLinuxMount": false
    }
  },
  "requestReceivedTimestamp": "2026-07-02T21:32:32.457469Z",
  "stageTimestamp": "2026-07-02T21:32:32.462369Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

deletecollection csidrivers

#
Resource
csidrivers

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/storage.k8s.io/v1/csidrivers?labelSelector=dw-harn-patched",
  "verb": "deletecollection",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=3ffde68ef687218e01296d94b0aa59c81cc98de2bd73ab70e21510c8cd4b9cec"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "csidrivers",
    "apiGroup": "storage.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "responseObject": {
    "kind": "CSIDriverList",
    "apiVersion": "storage.k8s.io/v1",
    "metadata": {
      "resourceVersion": "1181"
    },
    "items": [
      {
        "metadata": {
          "name": "dw-harn-csidrivers",
          "uid": "00000000-0000-0000-0000-000000000000",
          "resourceVersion": "1180",
          "creationTimestamp": "2026-07-02T23:14:43Z",
          "labels": {
            "dw-harn-patched": "1"
          }
        },
        "spec": {
          "attachRequired": false,
          "podInfoOnMount": false,
          "volumeLifecycleModes": [
            "Persistent"
          ],
          "storageCapacity": false,
          "fsGroupPolicy": "ReadWriteOnceWithFSType",
          "requiresRepublish": false,
          "seLinuxMount": false
        }
      }
    ]
  },
  "requestReceivedTimestamp": "2026-07-02T23:14:47.039613Z",
  "stageTimestamp": "2026-07-02T23:14:47.045091Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

any verb on csidrivers (synthetic aggregation)

#
Resource
csidrivers

Description

Synthetic aggregation for rules that filter the csidrivers resource with no specific verb. Not a distinct audit record; hosts rule listings that key on objectRef.resource alone.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
kubernetes.audit.stage (elastic rule field)eqresponsecomplete1 ruleelastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • Kubernetes Unusual Decision by User Agent source low: This rule detects unusual request responses in Kubernetes audit logs through the use of the "new_terms" rule type. In production environments, default API requests are typically made by system components or trusted users, who are expected to have a consistent user agent and allowed response annotations. By monitoring for anomalies in the username and response annotations, this rule helps identify potential unauthorized access or misconfigurations in the Kubernetes environment.T1078