Kubernetes service account token created in container

Classification:

attack

Tactic:

TA0002-execution

Technique:

T1609-container-administration-command

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Goal

Detect the use of kubectl inside a container to create a new service account token.

Strategy

This detection triggers when kubectl is executed with specific arguments related to creating a new service account token.

Triage and response

  1. Identify the purpose and scope of the service account.
  2. Confirm if the service account token being created is authorized.
  3. Determine the resources involved, such as new containers.
  4. Initiate the incident response process.
  5. Remediate compromised resources and repair the root cause.

Requires Agent version 7.27 or greater