Untrusted Node Successfully Joined the Cluster

Severity: ERROR
Source: k8saudit

Detect a node successfully joined the cluster outside of the list of allowed nodes.

Telemetry coverage

Platform	Record / event type
Kubernetes	create-nodes: create nodes

Rules detecting the same action

These rules filter on the same operation.

Direct Interactive Kubernetes API Request by Unusual Utilities (Elastic)
GKE API Server Proxying Request to Kubelet (Elastic)
Untrusted Node Unsuccessfully Tried to Join the Cluster (Falco)

Stages and Predicates

Stage 1: `falco_condition`

and
  not
    objectRef.name in
  jevt.rawtime is_null
  objectRef.resource eq "nodes"
  responseStatus.code starts_with "2"
  stage eq "ResponseComplete"
  verb eq "create"

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`objectRef.name`	in	(no value, null check)	`excludes:objectRef.name`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`jevt.rawtime`	is_null	(no value, null check)	`field:"jevt.rawtime" kind:is_null`
`objectRef.resource`	eq	`nodes`	`field:"objectRef.resource" kind:eq value:"nodes"`
`responseStatus.code`	starts_with	`2`	`field:"responseStatus.code" kind:starts_with value:"2"`
`stage`	in	`ResponseComplete`	`field:"stage" kind:in value:"ResponseComplete"`
`verb`	eq	`create`	`field:"verb" kind:eq value:"create"`