Kubernetes API Request Impersonating Privileged Identity

Detects Kubernetes API requests where a user is impersonating a privileged cluster identity such as system:kube-controller-manager, system:admin, system:anonymous, or a member of the system:masters group. These identities have broad cluster-wide permissions including unrestricted access to all secrets, the ability to create tokens for any service account, schedule pods on any node, and modify RBAC policies. An attacker impersonating system:masters gains full cluster-admin equivalent access, while impersonating system:kube-controller-manager grants access to every secret in every namespace and the ability to mint service account tokens for lateral movement.

ATT&CK coverage

Privilege Escalation

T1134Access Token ManipulationAlso under Stealth.28 detections cover this technique

Detection requirements

Log source category: event_index

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.

Sign in to read it Create an account

Detection catalogue

ATT&CK coverage

Detection requirements

Detection logic