KQL Search

Query Details

Kubernetes Pod Accessing Service Account Tokens

Query

let Lookback = 1d;
let AllowedNamespaces = dynamic([
	"kube-system",
	"gatekeeper-system",
	"azure-arc",
	"calico-system",
	"cilium"
]);
CloudProcessEvents
| where Timestamp > ago(Lookback)
| where isnotempty(KubernetesPodName)
| extend Command = tolower(ProcessCommandLine)
| where Command has_any ("/var/run/secrets/kubernetes.io/serviceaccount/token", "serviceaccount/token", "serviceaccount/ca.crt", "serviceaccount/namespace")
| where KubernetesNamespace !in (AllowedNamespaces)
| project Timestamp, Detection="K8S service account token access", AzureResourceId, KubernetesNamespace, KubernetesPodName, ContainerName, ContainerImageName, AccountName, ParentProcessName, ProcessName, ProcessCommandLine, HostName

About this query

Kubernetes Pod Accessing Service Account Tokens

Query Information

MITRE ATT&CK Technique(s)

Technique IDTitleLink
T1552.001Credentials in Fileshttps://attack.mitre.org/techniques/T1552/001

Description

Detects instances where a process within a containerized application attempts to access Kubernetes service account tokens or related files (token, ca.crt, namespace). Accessing these files from non-authorized namespaces may indicate an attempt by a compromised container to gain unauthorized access to the Kubernetes API.

Author <Optional>

Defender XDR

Explanation

This query is designed to detect suspicious activity within a Kubernetes environment. Specifically, it looks for instances where a process inside a container tries to access Kubernetes service account tokens or related files, such as token, ca.crt, or namespace. These files are typically used for authentication and authorization with the Kubernetes API.

Here's a simple breakdown of what the query does:

  1. Time Frame: It examines events from the past day (Lookback = 1d).

  2. Allowed Namespaces: It defines a list of namespaces (AllowedNamespaces) where accessing these files is considered normal and not suspicious. These include system-related namespaces like kube-system and gatekeeper-system.

  3. Event Filtering: The query filters events from CloudProcessEvents to find processes that:

    • Have a non-empty Kubernetes pod name.
    • Execute commands that include paths to the service account token files.
    • Belong to namespaces not listed in the AllowedNamespaces.

  4. Output: For each suspicious event, it provides details such as the timestamp, resource ID, namespace, pod name, container name, image name, account name, and process details.

In summary, this query helps identify potentially unauthorized access attempts to Kubernetes service account tokens by processes running in unexpected namespaces, which could indicate a security breach or misconfiguration.