New Kubernetes Service Account Created

Title: New Kubernetes Service Account Created
Status: test
Description:Detects creation of new Kubernetes service account, which could indicate an attacker's attempt to persist within a cluster.
References:
  -https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/container%20service%20account/
Author: Leo Tsaousis (@laripping)
Date: 2024-03-26
modified:None
Tags:

• -'attack.persistence'
• -'attack.t1136'

Logsource:

• category: application
• product: kubernetes
• service: audit

Detection:
  selection:
    verb: 'create'
    objectRef.resource: 'serviceaccounts'
  condition:selection
Falsepositives:
  -Unknown
Level: low