EKS Authentication Configuration Modified

  1[metadata]
  2creation_date = "2026/05/06"
  3integration = ["kubernetes"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects modifications to the aws-auth ConfigMap in Amazon EKS clusters. The aws-auth ConfigMap maps AWS IAM roles and
 11users to Kubernetes RBAC groups, an attacker who modifies it can grant any IAM role cluster-admin access by adding a
 12mapping to the system:masters group. This is a well-documented persistence technique that survives pod restarts, node
 13replacements, and RBAC changes because the authentication mapping exists outside of normal Kubernetes Role objects.
 14Modifications to aws-auth are rare in normal operations, the ConfigMap is typically set during cluster provisioning and
 15updated only during node group or access configuration changes.
 16"""
 17false_positives = [
 18    """
 19    Legitimate node group lifecycle, cluster upgrades, or infrastructure-as-code (Terraform, CloudFormation, eksctl) may
 20    update aws-auth during expected change windows. Baseline automation identities and expand exclusions beyond
 21    eks:kms-storage-migrator if your environment uses additional known controllers.
 22    """,
 23]
 24from = "now-9m"
 25index = ["logs-kubernetes.audit_logs-*"]
 26language = "kuery"
 27license = "Elastic License v2"
 28name = "EKS Authentication Configuration Modified"
 29note = """## Triage and analysis
 30
 31### Investigating EKS Authentication Configuration Modified
 32
 33Confirm who changed the mapping (user.name, groups, source.ip, user_agent.original) and whether the change aligns with
 34approved cluster or node-group operations. Compare the new aws-auth mapRoles/mapUsers content to the prior revision if
 35request/response capture is available in audit.
 36
 37### Possible investigation steps
 38
 39- Identify any new IAM role ARNs or users bound to system:masters or other privileged Kubernetes groups.
 40- Correlate the timestamp with AWS CloudTrail for related EKS or IAM API activity and with GitOps or pipeline commits.
 41- Review subsequent API activity from newly mapped IAM principals for secret access, RBAC changes, or workload deployment.
 42- If Access Entries are enabled, also review CloudTrail for eks:CreateAccessEntry, eks:AssociateAccessPolicy, and similar
 43  API calls around the same window.
 44
 45### Response and remediation
 46
 47- If unauthorized, revert aws-auth from a known-good backup, remove rogue map entries, and rotate or restrict IAM that
 48  could have performed the change.
 49- Audit IAM policies that allow eks:UpdateClusterConfig or broad ConfigMap write access to kube-system.
 50- Escalate per incident policy when system:masters mappings appear from unexpected IAM identities.
 51"""
 52references = [
 53    "https://docs.aws.amazon.com/eks/latest/userguide/auth-configmap.html",
 54    "https://docs.aws.amazon.com/eks/latest/userguide/access-entries.html"
 55]
 56risk_score = 73
 57rule_id = "5202697c-313b-4bf0-9029-73fe78cd4b6d"
 58severity = "high"
 59tags = [
 60    "Data Source: Kubernetes",
 61    "Domain: Kubernetes",
 62    "Use Case: Threat Detection",
 63    "Tactic: Persistence",
 64    "Tactic: Privilege Escalation",
 65    "Resources: Investigation Guide",
 66    "Noise: Low",
 67    "Performance: Fast",
 68    "Profile: Recommended",
 69    "Rule Type: Custom Query (KQL)",
 70    "Platform: Kubernetes",
 71    "Domain: Containers",
 72    "Domain: Cloud",
 73]
 74timestamp_override = "event.ingested"
 75type = "query"
 76query = '''
 77data_stream.dataset:"kubernetes.audit_logs" and 
 78kubernetes.audit.objectRef.resource:"configmaps" and 
 79kubernetes.audit.objectRef.name:"aws-auth" and 
 80kubernetes.audit.verb:("update" or "patch" or "delete") and 
 81kubernetes.audit.objectRef.namespace:"kube-system" and 
 82kubernetes.audit.annotations.authorization_k8s_io/decision:"allow" and
 83not user.name:"eks:kms-storage-migrator"
 84'''
 85
 86[[rule.threat]]
 87framework = "MITRE ATT&CK"
 88
 89[[rule.threat.technique]]
 90id = "T1098"
 91name = "Account Manipulation"
 92reference = "https://attack.mitre.org/techniques/T1098/"
 93
 94[[rule.threat.technique.subtechnique]]
 95id = "T1098.006"
 96name = "Additional Container Cluster Roles"
 97reference = "https://attack.mitre.org/techniques/T1098/006/"
 98
 99[rule.threat.tactic]
100id = "TA0003"
101name = "Persistence"
102reference = "https://attack.mitre.org/tactics/TA0003/"
103
104[[rule.threat]]
105framework = "MITRE ATT&CK"
106
107[[rule.threat.technique]]
108id = "T1098"
109name = "Account Manipulation"
110reference = "https://attack.mitre.org/techniques/T1098/"
111
112[[rule.threat.technique.subtechnique]]
113id = "T1098.006"
114name = "Additional Container Cluster Roles"
115reference = "https://attack.mitre.org/techniques/T1098/006/"
116
117[rule.threat.tactic]
118id = "TA0004"
119name = "Privilege Escalation"
120reference = "https://attack.mitre.org/tactics/TA0004/"