RBAC Permission Enumeration Attempt

Title: RBAC Permission Enumeration Attempt
Status: test
Description:Detects identities attempting to enumerate their Kubernetes RBAC permissions. In the early stages of a breach, attackers will aim to list the permissions they have within the compromised environment. In a Kubernetes cluster, this can be achieved by interacting with the API server, and querying the SelfSubjectAccessReview API via e.g. a "kubectl auth can-i --list" command. This will enumerate the Role-Based Access Controls (RBAC) rules defining the compromised user's authorization.
References:
  -https://www.elastic.co/guide/en/security/current/kubernetes-suspicious-self-subject-review.html
Author: Leo Tsaousis (@laripping)
Date: 2024-03-26
modified:None
Tags:

• -'attack.t1069.003'
• -'attack.t1087.004'
• -'attack.discovery'

Logsource:

• category: application
• product: kubernetes
• service: audit

Detection:
  selection:
    verb: 'create'
    apiGroup: 'authorization.k8s.io'
    objectRef.resource: 'selfsubjectrulesreviews'
  condition:selection
Falsepositives:
  -Unknown
Level: low