k8s:audit
Kubernetes API server audit log
Event keys are verb/resource
- Host type
- Kubernetes
- Tier, as a whole
- Minimum
- Cost class
- Included
- Techniques
- 18
- Rules listed
- 122
- Events
- 8
Why this tier
CISA/ASD priority source; OMB M-26-14 A1 (Identity used; our analysis); OMB M-26-14 A10 (Attack vectors and lateral movement; our analysis); OMB M-26-14 A3 (Object and data events; our analysis); OMB M-26-14 A4 (Privilege changes; our analysis); OMB M-26-14 A5 (Infrastructure changes; our analysis)
Licensing
- License or service
- kube-apiserver
- What is free
- Audit policy/backend flags
- What costs
- Nothing (your storage)
- As read on
- 2026-11-01
A vendor statement as read on the date shown; the cost class is the durable part.
Standards and guidance naming this source
| Requirement | Relation | Basis |
|---|---|---|
| OMB M-26-14: Identity used | Supports an activity | our analysis: user on every API request |
| OMB M-26-14: Object and data events | Supports an activity | our analysis: secrets and configmap reads |
| OMB M-26-14: Privilege changes | Supports an activity | our analysis: RBAC role bindings |
| OMB M-26-14: Infrastructure changes | Supports an activity | our analysis: workload create delete and modify |
| OMB M-26-14: Attack vectors and lateral movement | Supports an activity | our analysis: exec into pods |
| ASD ACSC / CISA et al.: Priority enterprise log sources | priority_source | quoted (cloud): logs generated by the cloud services, including logs for cloud APIs |
Techniques
- T1036.005 Match Legitimate Resource Name or Location
- T1053.007 Container Orchestration Job
- T1059.013 Container CLI/API
- T1078 Valid Accounts
- T1098.006 Additional Container Cluster Roles
- T1110.003 Password Spraying
- T1110.004 Credential Stuffing
- T1133 External Remote Services
- T1204.003 Malicious Image
- T1528 Steal Application Access Token
- T1543.005 Container Service
- T1550.001 Application Access Token
- T1552.001 Credentials In Files
- T1552.007 Container API
- T1609 Container Administration Command
- T1611 Escape to Host
- T1613 Container and Resource Discovery
- T1685 Disable or Modify Tools
Rules
Splunk 15
- Kubernetes AWS detect suspicious kubectl calls
- Kubernetes Abuse of Secret by Unusual Location
- Kubernetes Abuse of Secret by Unusual User Agent
- Kubernetes Abuse of Secret by Unusual User Group
- Kubernetes Abuse of Secret by Unusual User Name
- Kubernetes Access Scanning
- Kubernetes Create or Update Privileged Pod
- Kubernetes Cron Job Creation
- Kubernetes DaemonSet Deployed
- Kubernetes Node Port Creation
- Kubernetes Pod Created in Default Namespace
- Kubernetes Pod With Host Network Attachment
- Kubernetes Scanning by Unauthenticated IP Address
- Kubernetes Suspicious Image Pulling
- Kubernetes Unauthorized Access
Sigma 16
- Container With A hostPath Mount Created by Leo Tsaousis (@laripping)
- Creation Of Pod In System Namespace by Leo Tsaousis (@laripping)
- Deployment Deleted From Kubernetes Cluster by Leo Tsaousis (@laripping)
- Kubernetes Admission Controller Modification by kelnage
- Kubernetes CronJob/Job Modification by kelnage
- Kubernetes Events Deleted by Leo Tsaousis (@laripping)
- Kubernetes Potential Enumeration Activity by uniqu3-us3r
- Kubernetes Rolebinding Modification by kelnage
- Kubernetes Secrets Enumeration by Leo Tsaousis (@laripping)
- Kubernetes Secrets Modified or Deleted by kelnage
- Kubernetes Unauthorized or Unauthenticated Access by kelnage
- New Kubernetes Service Account Created by Leo Tsaousis (@laripping)
- Potential Remote Command Execution In Pod Container by Leo Tsaousis (@laripping)
- Potential Sidecar Injection Into Running Deployment by Leo Tsaousis (@laripping)
- Privileged Container Deployed by Leo Tsaousis (@laripping)
- RBAC Permission Enumeration Attempt by Leo Tsaousis (@laripping)
Elastic 91
- AWS EKS API Request Impersonating Privileged Identity
- AWS EKS API Server Proxying Request to Kubelet
- AWS EKS Admission Webhook Created or Modified
- AWS EKS Anonymous Request Authorized by Unusual User Agent
- AWS EKS Anonymous User Create/Update/Patch Pods Request
- AWS EKS Authentication Configuration Modified
- AWS EKS Client Certificate Signing Request Created or Approved
- AWS EKS Cluster-Admin Role Binding Created
- AWS EKS Container Created with Excessive Linux Capabilities
- AWS EKS CoreDNS or Kube-DNS Configuration Modified
- AWS EKS Creation of a RoleBinding Referencing a ServiceAccount
- AWS EKS Creation or Modification of Sensitive Role
- AWS EKS Ephemeral Container Added to Pod
- AWS EKS Events Deleted
- AWS EKS Exposed Service Created With Type NodePort
- AWS EKS Forbidden Creation Request
- AWS EKS Forbidden Request from Unusual User Agent
- AWS EKS Multi-Resource Discovery
- AWS EKS Pod Created With HostIPC
- AWS EKS Pod Created With HostNetwork
- AWS EKS Pod Created With HostPID
- AWS EKS Pod Created with a Sensitive hostPath Volume
- AWS EKS Pod Exec Cloud Instance Metadata Access
- AWS EKS Pod Exec Potential Reverse Shell
- AWS EKS Pod Exec Sensitive File or Credential Path Access
- AWS EKS Pod Exec with Curl or Wget to HTTPS
- AWS EKS Potential Endpoint Permission Enumeration Attempt Detected
- AWS EKS Potential Endpoint Permission Enumeration Attempt by Anonymous User Detected
- AWS EKS Privileged Pod Created
- AWS EKS RBAC Wildcard Elevation on Existing Role
- AWS EKS Rapid Secret GET Activity Against Multiple Objects
- AWS EKS Secret get or list from Node or Pod Service Account
- AWS EKS Secret get or list with Suspicious User Agent
- AWS EKS Secrets List Across Cluster or Sensitive Namespaces
- AWS EKS Sensitive RBAC Change Followed by Workload Modification
- AWS EKS Service Account Modified RBAC Objects
- AWS EKS Service Account Token Created via TokenRequest API
- AWS EKS Suspicious Assignment of Controller Service Account
- AWS EKS Suspicious Self-Subject Review via Unusual User Agent
- AWS EKS Unusual Decision by User Agent
- AWS EKS Unusual Kubernetes Sensitive Workload Modification
- AWS EKS User Exec into Pod
- Direct Interactive Kubernetes API Request by Common Utilities
- Direct Interactive Kubernetes API Request by Unusual Utilities
- EKS Authentication Configuration Modified
- Forbidden Direct Interactive Kubernetes API Request
- Kubernetes API Request Impersonating Privileged Identity
- Kubernetes API Server Proxying Request to Kubelet
- Kubernetes Admission Webhook Created or Modified
- Kubernetes Anonymous Request Authorized by Unusual User Agent
- Kubernetes Anonymous User Create/Update/Patch Pods Request
- Kubernetes Client Certificate Signing Request Created or Approved
- Kubernetes Cluster-Admin Role Binding Created
- Kubernetes Container Created with Excessive Linux Capabilities
- Kubernetes CoreDNS or Kube-DNS Configuration Modified
- Kubernetes Creation of a RoleBinding Referencing a ServiceAccount
- Kubernetes Creation or Modification of Sensitive Role
- Kubernetes Ephemeral Container Added to Pod
- Kubernetes Events Deleted
- Kubernetes Exposed Service Created With Type NodePort
- Kubernetes Forbidden Creation Request
- Kubernetes Forbidden Request from Unusual User Agent
- Kubernetes Multi-Resource Discovery
- Kubernetes Pod Created With HostIPC
- Kubernetes Pod Created With HostNetwork
- Kubernetes Pod Created With HostPID
- Kubernetes Pod Created with a Sensitive hostPath Volume
- Kubernetes Pod Creation Using Common Debug or Base Images
- Kubernetes Pod Exec Cloud Instance Metadata Access
- Kubernetes Pod Exec Potential Reverse Shell
- Kubernetes Pod Exec Sensitive File or Credential Path Access
- Kubernetes Pod Exec with Curl or Wget to HTTPS
- Kubernetes Potential Endpoint Permission Enumeration Attempt Detected
- Kubernetes Potential Endpoint Permission Enumeration Attempt by Anonymous User Detected
- Kubernetes Privileged Pod Created
- Kubernetes RBAC Wildcard Elevation on Existing Role
- Kubernetes Rapid Secret GET Activity Against Multiple Objects
- Kubernetes Secret Access via Unusual User Agent
- Kubernetes Secret Get or List from Node or Pod Service Account
- Kubernetes Secret Get or List with Suspicious User Agent
- Kubernetes Secret or ConfigMap Access via Azure Arc Proxy
- Kubernetes Secrets List Across Cluster or Sensitive Namespaces
- Kubernetes Sensitive RBAC Change Followed by Workload Modification
- Kubernetes Service Account Modified RBAC Objects
- Kubernetes Service Account Token Created via TokenRequest API
- Kubernetes Suspicious Assignment of Controller Service Account
- Kubernetes Suspicious Self-Subject Review via Unusual User Agent
- Kubernetes User Exec into Pod
- Multiple Cloud Secrets Accessed by Source Address
- Service Account Token or Certificate Access Followed by Kubernetes API Request
- Unusual Kubernetes Sensitive Workload Modification