RBAC Permission Enumeration Attempt

Leo Tsaousis (@laripping)

Detects identities attempting to enumerate their Kubernetes RBAC permissions. In the early stages of a breach, attackers will aim to list the permissions they have within the compromised environment. In a Kubernetes cluster, this can be achieved by interacting with the API server, and querying the SelfSubjectAccessReview API via e.g. a "kubectl auth can-i --list" command. This will enumerate the Role-Based Access Controls (RBAC) rules defining the compromised user's authorization.

2024-03-26 00:00:00

None

84b777bd-c946-4d17-aa2e-c39f5a454325

attack.t1069.003 attack.t1087.004 DEMO

Community Rule

Leo Tsaousis

Merge PR #4694 from @LAripping - Add native Kubernetes detections

2024-03-26