New Kubernetes Service Account Created

Status: test
Severity: low
Log source: category application, product kubernetes, service audit
Author: Leo Tsaousis (@laripping)
Source: github.com/SigmaHQ/sigma

Detects creation of new Kubernetes service account, which could indicate an attacker's attempt to persist within a cluster.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1136` Create Account

Telemetry coverage

Platform	Record / event type
Kubernetes	create-serviceaccounts: create serviceaccounts

Rules detecting the same action

These rules filter on the same operation.

Azure AKS Service Account Token Created via TokenRequest API (Elastic)
Direct Interactive Kubernetes API Request by Unusual Utilities (Elastic)
GKE Service Account Token Created via TokenRequest API (Elastic)
K8s Serviceaccount Created (Falco)
Kubernetes Long-Lived Service Account Token Created (Panther)
Kubernetes Service Account Token Created via TokenRequest API (Elastic)
Service Account Created in Kube Namespace (Falco)

Rule body

title: New Kubernetes Service Account Created
id: e31bae15-83ed-473e-bf31-faf4f8a17d36
related:
    - id: 12d027c3-b48c-4d9d-8bb6-a732200034b2
      type: derived
status: test
description: |
    Detects creation of new Kubernetes service account, which could indicate an attacker's attempt to persist within a cluster.
references:
    - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/container%20service%20account/
author: Leo Tsaousis (@laripping)
date: 2024-03-26
tags:
    - attack.persistence
    - attack.t1136
logsource:
    category: application
    product: kubernetes
    service: audit
detection:
    selection:
        verb: 'create'
        objectRef.resource: 'serviceaccounts'
    condition: selection
falsepositives:
    - Unknown
level: low

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    verb: 'create'
    objectRef.resource: 'serviceaccounts'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`objectRef.resource`	eq	`serviceaccounts`	`field:"objectRef.resource" kind:eq value:"serviceaccounts"`
`verb`	eq	`create`	`field:"verb" kind:eq value:"create"`