A Kubernetes dashboard service account was used outside the cluster

Analytics BIOC Medium

A Kubernetes dashboard service account was used outside the cluster

A Kubernetes dashboard service account was successfully used externally of the Kubernetes environment, which may indicate that the dashboard is exposed to the internet and does not require authentication.

Module:: Cortex Cloud
Licensed by:: Cloud Runtime Security (CRS)
Data source:: AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs

ATT&CK tactics: Initial Access (TA0001)

ATT&CK techniques: External Remote Services (T1133)

Detector tags: Kubernetes - API

Attacker's goals:

Gain initial access to the Kubernetes cluster.

Investigative actions:

Determine which Kubernetes resources were accessed through the dashboard. Check whether any changes were made to the Kubernetes cluster.

Test period:: N/A (single event)
Deduplication:: 5 Days

1 variation:

A Kubernetes dashboard service account was unsuccessfully used outside the cluster Low (parent: Medium)