Service Account Created in Kube Namespace

Severity: WARNING
Source: k8saudit

Detect any attempt to create a serviceaccount in the kube-system or kube-public namespaces

Telemetry coverage

Platform	Record / event type
Kubernetes	create-serviceaccounts: create serviceaccounts

Rules detecting the same action

These rules filter on the same operation.

Azure AKS Service Account Token Created via TokenRequest API (Elastic)
Direct Interactive Kubernetes API Request by Unusual Utilities (Elastic)
GKE Service Account Token Created via TokenRequest API (Elastic)
K8s Serviceaccount Created (Falco)
Kubernetes Long-Lived Service Account Token Created (Panther)
Kubernetes Service Account Token Created via TokenRequest API (Elastic)
New Kubernetes Service Account Created (Sigma)

Stages and Predicates

Stage 1: `falco_condition`

and
  not
    objectRef.name in ["coredns", "coredns-autoscaler", "cronjob-controller", "daemon-set-controller", "deployment-controller", "disruption-controller", "endpoint-controller", "endpointslice-controller", "endpointslicemirroring-controller", "generic-garbage-collector", "horizontal-pod-autoscaler", "job-controller", "namespace-controller", "node-controller", "persistent-volume-binder", "pod-garbage-collector", "pv-protection-controller", "pvc-protection-controller", "replicaset-controller", "resourcequota-controller", "root-ca-cert-publisher", "service-account-controller", "statefulset-controller"]
  objectRef.namespace in ["kube-public", "kube-system"]
  objectRef.resource eq "serviceaccounts"
  responseStatus.code starts_with "2"
  stage eq "ResponseComplete"
  verb eq "create"

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`objectRef.name`	in	`coredns`, `coredns-autoscaler`, `cronjob-controller`, `daemon-set-controller`, `deployment-controller`, `disruption-controller`, `endpoint-controller`, `endpointslice-controller`, `endpointslicemirroring-controller`, `generic-garbage-collector`, `horizontal-pod-autoscaler`, `job-controller`, `namespace-controller`, `node-controller`, `persistent-volume-binder`, `pod-garbage-collector`, `pv-protection-controller`, `pvc-protection-controller`, `replicaset-controller`, `resourcequota-controller`, `root-ca-cert-publisher`, `service-account-controller`, `statefulset-controller`	`excludes:objectRef.name`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`objectRef.namespace`	in	`kube-public` `kube-system`	`field:"objectRef.namespace" kind:in`
`objectRef.resource`	eq	`serviceaccounts`	`field:"objectRef.resource" kind:eq value:"serviceaccounts"`
`responseStatus.code`	starts_with	`2`	`field:"responseStatus.code" kind:starts_with value:"2"`
`stage`	in	`ResponseComplete`	`field:"stage" kind:in value:"ResponseComplete"`
`verb`	eq	`create`	`field:"verb" kind:eq value:"create"`