Detection rules › Falco
Full K8s Administrative Access
Detect any k8s operation by a user name that may be an administrator with full access.
Stages and Predicates
Stage 1: falco_condition
and
not
user.username starts_with "system:"
jevt.rawtime is_null
stage eq "ResponseComplete"
user.username in ["admin", "kubernetes-admin", "kubernetes-admin@cluster.local", "kubernetes-admin@kubernetes", "minikube-user"]
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
user.username | starts_with | system: | excludes:user.username field:"user.username" value:"system:" |
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
jevt.rawtime | is_null | field:"jevt.rawtime" kind:is_null | |
stage | in |
| field:"stage" kind:in value:"ResponseComplete" |
user.username | in |
| field:"user.username" kind:in |