Azure AKS API Server Proxying Request to Kubelet

  1[metadata]
  2creation_date = "2026/07/09"
  3integration = ["azure"]
  4maturity = "production"
  5updated_date = "2026/07/09"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects a non-system identity using the AKS (Azure Kubernetes Service) API server nodes/proxy subresource to reach a
 11node's Kubelet. Proxying through the API server reaches the Kubelet API to enumerate pods or run commands on nodes, a
 12lateral-movement and privilege-escalation vector (kubeletctl, Peirates). Node, control-plane, and kube-system service
 13account identities that routinely proxy for monitoring are excluded, so remaining matches, including compromised
 14workload service accounts, are surfaced for review.
 15"""
 16false_positives = [
 17    """
 18    Monitoring and log-collection agents that run outside kube-system (for example a metrics agent in its own namespace)
 19    proxy to the Kubelet on every scrape and will match repeatedly. Add targeted exclusions for verified monitoring
 20    service accounts and namespaces after review.
 21    """,
 22]
 23from = "now-9m"
 24index = ["logs-azure.platformlogs-*"]
 25language = "kuery"
 26license = "Elastic License v2"
 27name = "Azure AKS API Server Proxying Request to Kubelet"
 28note = """## Triage and analysis
 29
 30### Investigating Azure AKS API Server Proxying Request to Kubelet
 31
 32AKS kube-audit events are carried under the flattened `azure.platformlogs.properties.log.*` subtree and share the ARM
 33operation `event.action: Microsoft.ContainerService/managedClusters/diagnosticLogs/Read`. The `nodes/proxy` subresource
 34tunnels a request through the API server to a node's Kubelet. An identity with this permission can enumerate pods
 35(`/proxy/pods`, `/proxy/runningpods`) or run commands (`/proxy/run`, `/proxy/exec`) on nodes without direct network
 36access to the Kubelet port. This rule excludes the node, control-plane, and kube-system service-account identities that
 37routinely proxy for monitoring, so remaining matches are workload identities or users that should rarely, if ever, reach
 38the Kubelet.
 39
 40### Possible investigation steps
 41
 42- Identify the acting identity in `azure.platformlogs.properties.log.user.username` and whether a workload service
 43  account or user should reach the Kubelet at all. Compromised pod service accounts (`system:serviceaccount:<ns>:<name>`)
 44  are the primary vehicle for this technique.
 45- Inspect the proxied Kubelet endpoint in `azure.platformlogs.properties.log.requestURI`. `/metrics` and `/stats` are
 46  monitoring; `/pods` and `/runningpods` are reconnaissance; `/run`, `/exec`, `/attach`, and `/portforward` are command
 47  execution and warrant immediate escalation.
 48- Evaluate `azure.platformlogs.properties.log.sourceIPs`. This is an array; for an externally operated attack the first
 49  element is the operator's real client IP, while the trailing entry is the internal API-server/konnectivity hop
 50  (`172.31.x`). A first entry that is not the cluster's own egress is a strong signal. In-cluster pivots show only
 51  internal addresses, so absence of an external IP does not clear the event.
 52- Review the target node in `azure.platformlogs.properties.log.objectRef.name` and correlate with subsequent activity on
 53  that node's workloads (secret reads, RBAC changes, new pods).
 54
 55### False positive analysis
 56
 57- Monitoring and log-collection agents outside kube-system proxy to the Kubelet on every scrape and will match
 58  repeatedly; add targeted exclusions for verified monitoring service accounts and namespaces.
 59
 60### Response and remediation
 61
 62- If unauthorized, revoke the acting identity's tokens and review the RBAC that granted `nodes/proxy`.
 63- Inspect the target node for command execution, dropped tooling, or credential theft, and rotate credentials reachable
 64  from affected pods.
 65- Note that direct Kubelet access on port 10250 bypasses the API server and does not appear in kube-audit; treat a
 66  confirmed proxy abuse as possible evidence of broader Kubelet access.
 67- Collect kube-audit and identity artifacts per incident response procedures.
 68"""
 69references = [
 70    "https://kubernetes.io/docs/reference/access-authn-authz/kubelet-authn-authz/",
 71    "https://stratus-red-team.cloud/attack-techniques/kubernetes/k8s.privilege-escalation.nodes-proxy/",
 72    "https://horizon3.ai/attack-research/when-read-only-isnt-k8s-nodes-proxy-get-to-rce/",
 73    "https://microsoft.github.io/Threat-Matrix-for-Kubernetes/",
 74    "https://github.com/inguardians/peirates",
 75]
 76risk_score = 47
 77rule_id = "dd43c618-6a5b-465b-8ae4-ce69e34ddac0"
 78setup = "The Azure Fleet integration collecting AKS diagnostic logs with the `kube-audit` category forwarded through Event Hub into the `azure.platformlogs` data stream is required for this rule."
 79severity = "medium"
 80tags = [
 81    "Domain: Cloud",
 82    "Domain: Kubernetes",
 83    "Data Source: Azure",
 84    "Data Source: Azure Platform Logs",
 85    "Data Source: Kubernetes",
 86    "Use Case: Threat Detection",
 87    "Tactic: Lateral Movement",
 88    "Tactic: Execution",
 89    "Resources: Investigation Guide",
 90]
 91timestamp_override = "event.ingested"
 92type = "query"
 93
 94query = '''
 95data_stream.dataset:azure.platformlogs and
 96  event.action:"Microsoft.ContainerService/managedClusters/diagnosticLogs/Read" and
 97  azure.platformlogs.category:"kube-audit" and
 98  azure.platformlogs.properties.log.objectRef.resource:"nodes" and
 99  azure.platformlogs.properties.log.objectRef.subresource:"proxy" and
100  not azure.platformlogs.properties.log.user.username:(
101    system\:node\:* or "aksService" or "hcpService" or "readinessChecker" or
102    system\:serviceaccount\:kube-system\:*
103  )
104'''
105
106
107[[rule.threat]]
108framework = "MITRE ATT&CK"
109[[rule.threat.technique]]
110id = "T1210"
111name = "Exploitation of Remote Services"
112reference = "https://attack.mitre.org/techniques/T1210/"
113
114
115[rule.threat.tactic]
116id = "TA0008"
117name = "Lateral Movement"
118reference = "https://attack.mitre.org/tactics/TA0008/"
119[[rule.threat]]
120framework = "MITRE ATT&CK"
121[[rule.threat.technique]]
122id = "T1609"
123name = "Container Administration Command"
124reference = "https://attack.mitre.org/techniques/T1609/"
125
126
127[rule.threat.tactic]
128id = "TA0002"
129name = "Execution"
130reference = "https://attack.mitre.org/tactics/TA0002/"
131
132[rule.investigation_fields]
133field_names = [
134    "@timestamp",
135    "event.action",
136    "azure.platformlogs.category",
137    "azure.platformlogs.properties.log.verb",
138    "azure.platformlogs.properties.log.user.username",
139    "azure.platformlogs.properties.log.sourceIPs",
140    "azure.platformlogs.properties.log.requestURI",
141    "azure.platformlogs.properties.log.objectRef.resource",
142    "azure.platformlogs.properties.log.objectRef.subresource",
143    "azure.platformlogs.properties.log.objectRef.name",
144]