detection.wiki

Leases

OperationDescriptionSampleRule
get-leasesReads a single Lease, used for kubelet heartbeats and controller leader-election. Elastic's new-terms rule watches this resource for a not-previously-seen actor.YN
list-leasesLists Leases across a namespace. Routine kubelet/controller leader-election chatter dominates this call; Elastic's new-terms rule tracks a first-seen actor.YN
watch-leasesOpens a long-lived watch on Lease changes. High-volume by design, since every node's kubelet and every leader-elected controller renews its Lease every few seconds.YN
create-leasesYN
update-leasesYN
patch-leasesRenews or modifies a Lease's holder identity and expiry. Elastic's new-terms rule flags a first-seen actor doing this outside expected kubelet/controller renewal.YN
delete-leasesYN
deletecollection-leasesYN
any-leasesSynthetic aggregation for rules that filter the leases resource with no specific verb. Not a distinct audit record; hosts rule listings that key on objectRef.resource alone.NY

get leases

#
Resource
leases

Description

Reads a single Lease, used for kubelet heartbeats and controller leader-election. Elastic's new-terms rule watches this resource for a not-previously-seen actor.

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/coordination.k8s.io/v1/namespaces/dw-harn/leases/dw-harn-leases",
  "verb": "get",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "leases",
    "namespace": "dw-harn",
    "name": "dw-harn-leases",
    "apiGroup": "coordination.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T04:47:56.980964Z",
  "stageTimestamp": "2026-07-02T04:47:56.982444Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

list leases

#
Resource
leases

Description

Lists Leases across a namespace. Routine kubelet/controller leader-election chatter dominates this call; Elastic's new-terms rule tracks a first-seen actor.

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/coordination.k8s.io/v1/namespaces/dw-harn/leases?limit=500&timeout=3s",
  "verb": "list",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "leases",
    "namespace": "dw-harn",
    "apiGroup": "coordination.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T04:47:57.105590Z",
  "stageTimestamp": "2026-07-02T04:47:57.106890Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

watch leases

#
Resource
leases

Description

Opens a long-lived watch on Lease changes. High-volume by design, since every node's kubelet and every leader-elected controller renews its Lease every few seconds.

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/coordination.k8s.io/v1/namespaces/dw-harn/leases?resourceVersion=1634&timeout=3s&watch=true",
  "verb": "watch",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "leases",
    "namespace": "dw-harn",
    "apiGroup": "coordination.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T04:47:57.108002Z",
  "stageTimestamp": "2026-07-02T04:48:00.108494Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

create leases

#
Resource
leases

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/coordination.k8s.io/v1/namespaces/dw-harn/leases?fieldManager=kubectl-create&fieldValidation=Strict",
  "verb": "create",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "leases",
    "namespace": "dw-harn",
    "name": "dw-harn-leases",
    "apiGroup": "coordination.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 201
  },
  "requestObject": {
    "kind": "Lease",
    "apiVersion": "coordination.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-leases",
      "namespace": "dw-harn"
    },
    "spec": {
      "holderIdentity": "dw-harn",
      "leaseDurationSeconds": 60
    }
  },
  "responseObject": {
    "kind": "Lease",
    "apiVersion": "coordination.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-leases",
      "namespace": "dw-harn",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1632",
      "creationTimestamp": "2026-07-02T04:47:56Z"
    },
    "spec": {
      "holderIdentity": "dw-harn",
      "leaseDurationSeconds": 60
    }
  },
  "requestReceivedTimestamp": "2026-07-02T04:47:56.918149Z",
  "stageTimestamp": "2026-07-02T04:47:56.920964Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

update leases

#
Resource
leases

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/coordination.k8s.io/v1/namespaces/dw-harn/leases/dw-harn-leases?fieldManager=kubectl-replace&fieldValidation=Strict",
  "verb": "update",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=4cf95d11cbd90036bab41cdc6b88cc8f91550e9135ed4bb61495b02f647812ff"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "leases",
    "namespace": "dw-harn",
    "name": "dw-harn-leases",
    "uid": "00000000-0000-0000-0000-000000000000",
    "apiGroup": "coordination.k8s.io",
    "apiVersion": "v1",
    "resourceVersion": "795"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {
    "kind": "Lease",
    "apiVersion": "coordination.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-leases",
      "namespace": "dw-harn",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "795",
      "creationTimestamp": "2026-07-02T21:31:25Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "holderIdentity": "dw-harn",
      "leaseDurationSeconds": 60
    }
  },
  "responseObject": {
    "kind": "Lease",
    "apiVersion": "coordination.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-leases",
      "namespace": "dw-harn",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "795",
      "creationTimestamp": "2026-07-02T21:31:25Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "holderIdentity": "dw-harn",
      "leaseDurationSeconds": 60
    }
  },
  "requestReceivedTimestamp": "2026-07-02T21:31:28.709291Z",
  "stageTimestamp": "2026-07-02T21:31:28.711724Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

patch leases

#
Resource
leases

Description

Renews or modifies a Lease's holder identity and expiry. Elastic's new-terms rule flags a first-seen actor doing this outside expected kubelet/controller renewal.

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/coordination.k8s.io/v1/namespaces/dw-harn/leases/dw-harn-leases?fieldManager=kubectl-patch",
  "verb": "patch",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "leases",
    "namespace": "dw-harn",
    "name": "dw-harn-leases",
    "apiGroup": "coordination.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {
    "metadata": {
      "labels": {
        "dw-harn-patched": "1"
      }
    }
  },
  "responseObject": {
    "kind": "Lease",
    "apiVersion": "coordination.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-leases",
      "namespace": "dw-harn",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1638",
      "creationTimestamp": "2026-07-02T04:47:56Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "holderIdentity": "dw-harn",
      "leaseDurationSeconds": 60
    }
  },
  "requestReceivedTimestamp": "2026-07-02T04:48:00.184474Z",
  "stageTimestamp": "2026-07-02T04:48:00.190351Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

delete leases

#
Resource
leases

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/coordination.k8s.io/v1/namespaces/dw-harn/leases/dw-harn-leases",
  "verb": "delete",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "leases",
    "namespace": "dw-harn",
    "name": "dw-harn-leases",
    "apiGroup": "coordination.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "status": "Success",
    "details": {
      "name": "dw-harn-leases",
      "group": "coordination.k8s.io",
      "kind": "leases",
      "uid": "00000000-0000-0000-0000-000000000000"
    },
    "code": 200
  },
  "requestObject": {
    "kind": "DeleteOptions",
    "apiVersion": "meta.k8s.io/__internal",
    "propagationPolicy": "Background"
  },
  "responseObject": {
    "kind": "Status",
    "apiVersion": "v1",
    "metadata": {},
    "status": "Success",
    "details": {
      "name": "dw-harn-leases",
      "group": "coordination.k8s.io",
      "kind": "leases",
      "uid": "00000000-0000-0000-0000-000000000000"
    }
  },
  "requestReceivedTimestamp": "2026-07-02T04:48:00.254073Z",
  "stageTimestamp": "2026-07-02T04:48:00.257378Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

deletecollection leases

#
Resource
leases

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/coordination.k8s.io/v1/namespaces/dw-harn/leases?labelSelector=dw-harn-patched",
  "verb": "deletecollection",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=3ffde68ef687218e01296d94b0aa59c81cc98de2bd73ab70e21510c8cd4b9cec"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "leases",
    "namespace": "dw-harn",
    "apiGroup": "coordination.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "responseObject": {
    "kind": "LeaseList",
    "apiVersion": "coordination.k8s.io/v1",
    "metadata": {
      "resourceVersion": "934"
    },
    "items": [
      {
        "metadata": {
          "name": "dw-harn-leases",
          "namespace": "dw-harn",
          "uid": "00000000-0000-0000-0000-000000000000",
          "resourceVersion": "934",
          "creationTimestamp": "2026-07-02T23:13:27Z",
          "labels": {
            "dw-harn-patched": "1"
          }
        },
        "spec": {
          "holderIdentity": "dw-harn",
          "leaseDurationSeconds": 60
        }
      }
    ]
  },
  "requestReceivedTimestamp": "2026-07-02T23:13:31.424428Z",
  "stageTimestamp": "2026-07-02T23:13:31.429671Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

any verb on leases (synthetic aggregation)

#
Resource
leases

Description

Synthetic aggregation for rules that filter the leases resource with no specific verb. Not a distinct audit record; hosts rule listings that key on objectRef.resource alone.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • Kubernetes Unusual Decision by User Agent source low: This rule detects unusual request responses in Kubernetes audit logs through the use of the "new_terms" rule type. In production environments, default API requests are typically made by system components or trusted users, who are expected to have a consistent user agent and allowed response annotations. By monitoring for anomalies in the username and response annotations, this rule helps identify potential unauthorized access or misconfigurations in the Kubernetes environment.T1078