Detection rules › By event

Kubernetes-serviceaccounts

Event	Rules
get-serviceaccounts	2
list-serviceaccounts	2
watch-serviceaccounts	1
create-serviceaccounts	4
update-serviceaccounts	1
patch-serviceaccounts	1
delete-serviceaccounts	1
create-serviceaccounts-token	4
any-serviceaccounts	1

get-serviceaccounts

2 detection rules reference this event. View event page.

Elastic (2)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
GKE Multi-Resource Discovery severity medium T1613

list-serviceaccounts

2 detection rules reference this event. View event page.

Elastic (2)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
GKE Multi-Resource Discovery severity medium T1613

watch-serviceaccounts

1 detection rules reference this event. View event page.

Elastic (1)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610

create-serviceaccounts

4 detection rules reference this event. View event page.

Sigma (1)

New Kubernetes Service Account Created severity low T1136

Elastic (1)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610

Falco (2)

K8s Serviceaccount Created severity INFO
Service Account Created in Kube Namespace severity WARNING

update-serviceaccounts

1 detection rules reference this event. View event page.

Elastic (1)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610

patch-serviceaccounts

1 detection rules reference this event. View event page.

Elastic (1)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610

delete-serviceaccounts

1 detection rules reference this event. View event page.

Falco (1)

K8s Serviceaccount Deleted severity INFO

create-serviceaccounts-token

4 detection rules reference this event. View event page.

Elastic (3)

Azure AKS Service Account Token Created via TokenRequest API severity medium T1528
GKE Service Account Token Created via TokenRequest API severity medium T1552, T1552.007
Kubernetes Service Account Token Created via TokenRequest API severity medium T1552, T1552.007

Panther (1)

Kubernetes Long-Lived Service Account Token Created severity informational T1098, T1552

any-serviceaccounts

1 detection rules reference this event. View event page.

Elastic (1)

Kubernetes Multi-Resource Discovery severity medium T1613