Kubernetes and Cloud Credential Path Access via Process Arguments

  1[metadata]
  2creation_date = "2026/04/29"
  3integration = ["endpoint", "auditd_manager"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Flags Linux process executions whose arguments reference high-value Kubernetes service-account material, kubeconfig or
 11node PKI paths, or common cloud files, when invoked via typical file-reading utilities or from ephemeral directories. 
 12Useful for spotting in-cluster and hybrid credential theft early.
 13"""
 14false_positives = [
 15    """
 16    Legitimate backup, compliance scanners, or admin scripts that enumerate paths under /home or /var/run/secrets may
 17    match. Tune by parent process, image, or automation identity.
 18    """,
 19]
 20from = "now-9m"
 21index = ["auditbeat-*", "logs-auditd_manager.auditd-*", "logs-endpoint.events.process*"]
 22language = "kuery"
 23license = "Elastic License v2"
 24name = "Kubernetes and Cloud Credential Path Access via Process Arguments"
 25note = """## Triage and analysis
 26
 27### Investigating Kubernetes and Cloud Credential Path Access via Process Arguments
 28
 29Confirm whether the process user and parent chain are expected to read the matched path (for example a CI job,
 30bootstrap script, or kubelet). Reconstruct the full command line and check for piping, encoding, or exfiltration
 31patterns immediately after the read.
 32
 33### Possible investigation steps
 34
 35- Map the workload or login session to an identity; prioritize events from nodes, jump hosts, or pods with mounted
 36  service account tokens.
 37- Correlate with file, network, and Kubernetes audit telemetry for secret reads, token minting, or API calls using
 38  harvested material.
 39
 40### Response and remediation
 41
 42- Rotate affected service account tokens, kubeconfigs, and cloud keys when access was unauthorized; review RBAC and
 43  secret mount policy for the workload.
 44"""
 45references = [
 46    "https://attack.mitre.org/techniques/T1552/",
 47    "https://kubernetes.io/docs/concepts/security/service-accounts/",
 48]
 49risk_score = 73
 50rule_id = "5f0fff18-f340-444b-9a98-c49ade766ff4"
 51setup = """## Setup
 52
 53Requires **Elastic Defend** and/or **Auditd Manager** process telemetry (`logs-endpoint.events.process*`,
 54`logs-auditd_manager.auditd-*`, `auditbeat-*`) with command-line argument capture for exec events.
 55
 56### Elastic Defend
 57Install the Elastic Defend integration via Fleet on Linux hosts and use a policy that collects process events with
 58arguments.
 59
 60### Auditd Manager
 61Deploy Auditd Manager and ensure execve (or equivalent process) auditing is enabled so `process.args` and
 62`process.executable` populate for monitored binaries.
 63
 64See https://docs.elastic.co/integrations/auditd_manager
 65"""
 66severity = "high"
 67tags = [
 68    "Data Source: Auditd Manager",
 69    "Data Source: Elastic Defend",
 70    "Domain: Endpoint",
 71    "Domain: Kubernetes",
 72    "OS: Linux",
 73    "Use Case: Threat Detection",
 74    "Tactic: Credential Access",
 75    "Resources: Investigation Guide",
 76    "Noise: Medium",
 77    "Performance: Normal",
 78    "Rule Type: Custom Query (KQL)",
 79    "Platform: Linux",
 80    "Domain: Containers",
 81]
 82timestamp_override = "event.ingested"
 83type = "query"
 84query = '''
 85host.os.type:linux and event.category:process and event.action:(exec or executed) and 
 86(
 87  process.name:(
 88    busybox or cat or head or tail or more or less or sed or awk or 
 89    find or grep or ls or whereis or cp or mv or ln or
 90    curl or wget or scp or rsync or tar or zip or gzip or
 91    base64 or xxd or od or dd or tee or strings or xargs or jq or yq or
 92    openssl or ssh or sftp or nc or ncat or netcat or socat or
 93    python* or perl* or ruby* or node or php* or lua* or .*
 94  ) or
 95  process.args:(
 96    cat or head or tail or more or less or sed or awk or 
 97    find or grep or cp or mv or curl or wget or base64 or 
 98    tar or scp or dd or strings or xargs
 99  ) or
100  process.executable:(/tmp/* or /var/tmp/* or /dev/shm/* or /home/* or /run/user/*)
101) and process.args:(
102  "/var/run/secrets/kubernetes.io/serviceaccount/token" or
103  "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt" or
104  "/var/run/secrets/eks.amazonaws.com/serviceaccount/token" or
105  "/var/run/secrets/azure/tokens/azure-identity-token" or
106  "/var/run/secrets/tokens/azure-identity-token" or
107  "/var/lib/kubelet/kubeconfig" or
108  "/etc/kubernetes/admin.conf" or
109  "/etc/kubernetes/pki/ca.key" or
110  "/etc/kubernetes/pki/apiserver-kubelet-client.key" or
111  "/var/lib/kubelet/pki/kubelet-client-current.pem" or
112  "/etc/rancher/k3s/k3s.yaml" or
113  */.aws/credentials or
114  */.aws/cli/cache/*.json or
115  */.aws/sso/cache/*.json or
116  */.azure/accessTokens.json or
117  */.azure/azureProfile.json or
118  */.azure/msal_token_cache.json or
119  */confluence/confluence.cfg.xml or 
120  *confluence/conf/server.xml
121  */.config/gcloud/application_default_credentials.json or
122  */.config/gcloud/credentials.db or
123  */.config/gcloud/access_tokens.db or
124  */.config/gcloud/legacy_credentials or
125  */.kube/config or
126  */.docker/config.json
127) 
128'''
129
130[[rule.threat]]
131framework = "MITRE ATT&CK"
132
133[[rule.threat.technique]]
134id = "T1552"
135name = "Unsecured Credentials"
136reference = "https://attack.mitre.org/techniques/T1552/"
137
138[[rule.threat.technique.subtechnique]]
139id = "T1552.001"
140name = "Credentials In Files"
141reference = "https://attack.mitre.org/techniques/T1552/001/"
142
143
144[[rule.threat.technique]]
145id = "T1528"
146name = "Steal Application Access Token"
147reference = "https://attack.mitre.org/techniques/T1528/"
148
149[rule.threat.tactic]
150id = "TA0006"
151name = "Credential Access"
152reference = "https://attack.mitre.org/tactics/TA0006/"