Untrusted Node Unsuccessfully Tried to Join the Cluster

Severity: WARNING
Source: k8saudit

Detect an unsuccessful attempt to join the cluster for a node not in the list of allowed nodes.

Telemetry coverage

Platform	Record / event type
Kubernetes	create-nodes: create nodes

Rules detecting the same action

These rules filter on the same operation.

Direct Interactive Kubernetes API Request by Unusual Utilities (Elastic)
GKE API Server Proxying Request to Kubelet (Elastic)
Untrusted Node Successfully Joined the Cluster (Falco)

Stages and Predicates

Stage 1: `falco_condition`

and
  not
    objectRef.name in
  not
    responseStatus.code starts_with "2"
  jevt.rawtime is_null
  objectRef.resource eq "nodes"
  stage eq "ResponseComplete"
  verb eq "create"

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`objectRef.name`	in	(no value, null check)	`excludes:objectRef.name`
`responseStatus.code`	starts_with	`2`	`excludes:responseStatus.code` `field:"responseStatus.code" value:"2"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`jevt.rawtime`	is_null	(no value, null check)	`field:"jevt.rawtime" kind:is_null`
`objectRef.resource`	eq	`nodes`	`field:"objectRef.resource" kind:eq value:"nodes"`
`stage`	in	`ResponseComplete`	`field:"stage" kind:in value:"ResponseComplete"`
`verb`	eq	`create`	`field:"verb" kind:eq value:"create"`