Kubernetes service account token created in container
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel,
n'hésitez pas à nous contacter.
Deprecation Notice (June 5, 2026): This rule is deprecated in favor of the Container escape attack correlation rule, which combines multiple container escape signals into a single, higher-fidelity detection. Customers will automatically benefit from the improved correlation-based detection without any action required.
What happened
A kubectl command was used to create a new service account token, potentially to establish persistence or escalate privileges.
Goal
Detect the use of kubectl commands inside a container to create a new service account token.
Strategy
This detection triggers when kubectl is executed with specific arguments related to creating a new service account token.
Triage and response
- Identify the purpose and scope of the service account.
- Confirm if the service account token being created is authorized.
- Determine the resources involved, such as new containers.
- Initiate the incident response process.
- Remediate compromised resources and repair the root cause.
Requires Agent version 7.27 or greater
