Detection rules › Falco
Disallowed K8s User
Detect any k8s operation by users outside of an allowed set of users.
Stages and Predicates
Stage 1: falco_condition
and
not
user.username ends_with "@container-engine-robot.iam.gserviceaccount.com"
not
user.username in ["admin", "cloud-controller-manager", "cluster-autoscaler", "kops", "kube", "kube-apiserver-healthcheck", "kube-proxy", "kubelet", "kubernetes-admin", "minikube", "minikube-user", "system:addon-manager", "system:kube-controller-manager", "vpa-recommender", "vpa-updater"]
not
user.username in ["eks:addon-manager", "eks:authenticator", "eks:certificate-controller", "eks:cloud-controller-manager", "eks:cluster-event-watcher", "eks:fargate-scheduler", "eks:k8s-metrics", "eks:node-manager", "eks:nodewatcher", "eks:pod-identity-mutating-webhook", "eks:vpc-resource-controller"]
not
user.username starts_with "system:"
stage eq "ResponseComplete"
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
user.username | ends_with | @container-engine-robot.iam.gserviceaccount.com | excludes:user.username field:"user.username" value:"@container-engine-robot.iam.gserviceaccount.com" |
user.username | in | admin, cloud-controller-manager, cluster-autoscaler, kops, kube, kube-apiserver-healthcheck, kube-proxy, kubelet, kubernetes-admin, minikube, minikube-user, system:addon-manager, system:kube-controller-manager, vpa-recommender, vpa-updater | excludes:user.username |
user.username | in | eks:addon-manager, eks:authenticator, eks:certificate-controller, eks:cloud-controller-manager, eks:cluster-event-watcher, eks:fargate-scheduler, eks:k8s-metrics, eks:node-manager, eks:nodewatcher, eks:pod-identity-mutating-webhook, eks:vpc-resource-controller | excludes:user.username |
user.username | starts_with | system: | excludes:user.username field:"user.username" value:"system:" |
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
stage | in |
| field:"stage" kind:in value:"ResponseComplete" |