-
Detects the creation of an Amazon EKS access entry followed by its deletion by the same identity within a short time window. EKS access entries define Kubernetes RBAC-level permissions for IAM principals in an EKS cluster. An adversary with EKS administrative access may temporarily grant themselves cluster access, use those permissions to create Kubernetes RBAC resources (ClusterRoleBindings, ServiceAccounts with privileged roles), and then delete the access entry to hide the evidence of the initial grant while retaining access through the Kubernetes-level backdoor.
Read More -
AWS EKS Access Entry Granted Cluster Admin Policy
Sep 19, 2026 · Domain: Cloud Domain: Kubernetes Data Source: AWS Data Source: Amazon Web Services Data Source: AWS CloudTrail Use Case: Threat Detection Tactic: Privilege Escalation Tactic: Persistence Resources: Investigation Guide Noise: Low Performance: Normal Rule Type: Custom Query (KQL) Platform: AWS Domain: Containers Service: AWS EKS ·Detects when the AmazonEKSClusterAdminPolicy or AmazonEKSAdminPolicy is associated with a principal via the EKS Access Entries API. This grants full cluster-admin equivalent access to the specified IAM user or role. Unlike the legacy aws-auth ConfigMap which is only visible in Kubernetes audit logs, Access Entries modifications appear in CloudTrail, providing an additional detection surface. Attackers who have obtained IAM permissions to manage EKS access entries can use this API to backdoor cluster access for persistence, mapping attacker-controlled IAM identities to cluster-admin privileges without modifying any Kubernetes resources.
Read More -
AWS EKS Access Entry Modified
Sep 19, 2026 · Domain: Cloud Domain: Kubernetes Data Source: AWS Data Source: Amazon Web Services Data Source: AWS CloudTrail Use Case: Threat Detection Tactic: Persistence Tactic: Privilege Escalation Resources: Investigation Guide Noise: Low Performance: Fast Rule Type: Custom Query (KQL) Platform: AWS Domain: Containers Service: AWS EKS ·Detects successful Amazon EKS Access Entries API operations that create, update, attach, detach, or delete authentication mappings between IAM principals and the cluster. Changes to access entries alter who can authenticate to Kubernetes and what Kubernetes-level permissions they receive, without requiring edits to in-cluster RBAC objects. Unexpected callers or timing may indicate persistence or privilege abuse. Common automation identities (service-linked roles, eksctl, Terraform, CloudFormation role patterns) are excluded to reduce noise; tune further for your deployment pipelines.
Read More -
AWS EKS Control Plane Logging Disabled
Sep 19, 2026 · Domain: Cloud Domain: Kubernetes Data Source: AWS Data Source: Amazon Web Services Data Source: AWS CloudTrail Use Case: Threat Detection Tactic: Defense Evasion Resources: Investigation Guide Noise: Low Performance: Normal Rule Type: Custom Query (KQL) Platform: AWS Domain: Containers Service: AWS EKS ·Detects successful Amazon EKS UpdateClusterConfig requests that disable control plane logging. Disabling EKS API server and control plane logs can reduce visibility into cluster activity and may indicate defense evasion following compromised AWS credentials or unauthorized administrative access. EKS control plane logging changes are typically rare and should align with approved maintenance or cost optimization workflows.
Read More