Detection Pack Kubernetes

Kubernetes Detection Pack

46 detection rules for Kubernetes API server audit logs — covering RBAC privilege escalation, container escape, cryptomining workloads, and admission control bypass. Supports EKS, AKS, GKE, and self-managed clusters.

Activate this pack Kubernetes integration docs

Pack summary

Detection rules: 46
Critical severity: 12
Cluster distributions: EKS, AKS, GKE
ATT&CK techniques: 16

What's included

46 rules across 5 threat categories for Kubernetes security.

RBAC Privilege Escalation 14 rules

cluster-admin binding, wildcard roles, ServiceAccount token abuse, kube-system modification.

Container Escape 12 rules

Privileged pods, hostPID, hostNetwork, host volume mounts, exec into sensitive containers.

Supply Chain & Workload Integrity 8 rules

Untrusted image registries, mutating webhook modification, Helm chart provenance.

Persistence & Execution 7 rules

CronJob creation, DaemonSet deployment, ConfigMap with credentials, API backdoor accounts.

Audit & Control Plane Tampering 5 rules

API audit log disabling, admission controller removal, etcd direct access.

Detection rules (20 of 46 shown)

Showing 20 representative rules. All 46 rules activate with one click.

Rule name	Description	Severity	ATT&CK	Source
Kubernetes cluster-admin ClusterRoleBinding Created	cluster-admin ClusterRoleBinding grants full control over all cluster resources.	Critical	T1548	API Server Audit
Kubernetes Privileged Container Created	Pod created with privileged: true — can access host kernel and escape container isolation.	Critical	T1611	API Server Audit
Kubernetes exec into Running Container	kubectl exec used to access a running container shell — potential lateral movement.	High	T1609	API Server Audit
Kubernetes Anonymous Authentication Enabled	API server configured to allow anonymous (unauthenticated) requests.	Critical	T1562.001	API Server Audit
Kubernetes ServiceAccount Token Mounted from Sensitive Namespace	Pod mounts ServiceAccount token from kube-system or production namespace.	High	T1528	API Server Audit
Kubernetes Namespace Created and Immediately Used for Sensitive Workload	New namespace created and pods scheduled in it within minutes — evasion pattern.	High	T1059	API Server Audit
Kubernetes RBAC Role with Wildcards — Broad Permission Grant	ClusterRole or Role created with wildcard verbs and resources — overly permissive.	High	T1548	API Server Audit
Kubernetes Pod with hostPID or hostNetwork	Pod scheduled with host PID namespace or host network — container escape vector.	Critical	T1611	API Server Audit
Kubernetes Secrets Enumerated by Unexpected Service Account	ServiceAccount reads kubernetes Secrets it has no expected business need to access.	High	T1552.007	API Server Audit
Kubernetes CronJob Created for Persistence	CronJob created in a production namespace — scheduled execution for persistence.	High	T1053.007	API Server Audit
Kubernetes etcd Accessed Directly	Direct connection to etcd port (2379) detected outside of API server communication.	Critical	T1552	Network / Audit
Kubernetes ValidatingWebhookConfiguration Modified	Admission webhook modified — can disable security policy enforcement (OPA, Kyverno).	High	T1562.001	API Server Audit
Kubernetes Node Taint Removed — DaemonSet Bypass	Node taint removed enabling DaemonSets to schedule on previously restricted nodes.	Medium	T1548	API Server Audit
Kubernetes Image Pulled from Untrusted Registry	Pod scheduled using image from registry outside the organisation's allowed list.	High	T1195.002	API Server Audit
Kubernetes API Server Authentication Failure — Brute Force	High rate of 401 Unauthorized responses from API server — credential brute force.	High	T1110	API Server Audit
Kubernetes Namespace kube-system Modified by Non-Admin	Resource in kube-system modified by an account that is not a cluster admin.	Critical	T1548	API Server Audit
Kubernetes Pod Termination Rate Spike — Ransomware Pattern	Large number of pods terminated in rapid succession — potential ransomware or sabotage.	High	T1489	API Server Audit
Kubernetes ConfigMap Containing Credentials Created	ConfigMap created containing patterns consistent with API keys or passwords.	High	T1552.001	API Server Audit
Kubernetes Admission Controller (PodSecurityPolicy) Deleted	PodSecurityPolicy or PodSecurity admission control removed — enables privileged pod creation.	Critical	T1562.001	API Server Audit
Kubernetes API Server Audit Log Disabled	API server audit policy removed or audit log backend disabled.	Critical	T1562.008	Control Plane

Prerequisites

Kubernetes API server audit logging enabled with an audit policy that captures RequestResponse-level events for sensitive resources
For EKS: CloudWatch Logs enabled for API server and audit log types in cluster logging configuration
For AKS: Diagnostic settings configured to send kube-audit logs to Log Analytics or Event Hub
For GKE: Cloud Logging enabled for the cluster with API server audit logs forwarded

Kubernetes Detection Pack: frequently asked questions

What Kubernetes log sources does this detection pack use?

The Kubernetes detection pack uses the Kubernetes API Server audit log as its primary source. The audit log captures every request made to the API server — authentication, RBAC decisions, resource creation, modification, and deletion. Runtime security signals from Falco (if deployed) are also ingested for node-level detections. Cloud provider Kubernetes services (EKS, AKS, GKE) have specific audit log delivery mechanisms.

How does ManySignal ingest Kubernetes audit logs?

For cloud-managed Kubernetes (EKS, AKS, GKE), audit logs are streamed through the cloud provider's native log delivery service (CloudWatch, Azure Monitor, Cloud Logging). For self-managed clusters, ManySignal deploys a lightweight log forwarder as a DaemonSet that tails the API server audit log file and ships events. Both paths produce the same normalised event schema.

Can ManySignal detect container escape attempts?

Yes. Container escape detection covers privileged containers, hostPID/hostNetwork pod specs, volume mounts targeting host filesystems (/, /proc, /sys), and exec-based access to privileged containers. Runtime-level escape attempts (ptrace, kernel module loading) require Falco integration for syscall-level visibility.

Does this pack cover Kubernetes supply chain attacks?

Yes. Supply chain coverage includes: images pulled from untrusted registries, InitContainer scripts that download and execute payloads, mutating webhooks that modify pod specs at admission time, and Helm chart deployments from unverified repositories. Image signing verification via Cosign or Notary v2 integration is also supported.

How does ManySignal handle managed Kubernetes differences (EKS vs GKE vs AKS)?

ManySignal normalises audit events from all three managed Kubernetes services into a common schema. Cloud-specific variations (EKS uses CloudWatch, AKS uses Azure Monitor, GKE uses Cloud Logging) are handled by the cloud-specific connector. The detection pack rules run against the normalised schema and are identical across all three providers.

Detect Kubernetes privilege escalation and container escape

46 Kubernetes detection rules covering RBAC abuse, container escape, supply chain attacks, and cluster control plane tampering.

Book a demo Explore the platform