Kubernetes Permission Discovery via Kubectl

The command 'kubectl auth can-i' is a native Kubernetes utility designed to allow administrators and developers to verify their access rights against the Kubernetes API. While legitimate, this command is frequently leveraged by threat actors to perform reconnaissance once an initial foothold within a container or cluster-connected host is achieved. By systematically probing the API, an attacker can determine the extent of their current privileges, identify over-privileged service accounts, and pinpoint paths for lateral movement or privilege escalation. This activity is critical for detection engineering teams to monitor, as it often precedes more destructive actions in the cluster environment. The risk associated with this activity is particularly high in environments where RBAC is overly permissive or where service accounts are exposed to unauthorized actors.

Impact

Successful reconnaissance of cluster permissions allows attackers to map the attack surface of the Kubernetes API, leading to potential unauthorized data access, persistence within the cluster, and full cluster compromise. This behavior is commonly observed during the discovery phase of container-focused campaigns, where attackers aim to move beyond an initial compromised pod.

Recommendation

Prioritize the implementation of process-level monitoring for kubectl command-line arguments to distinguish between routine administrative tasks and potential reconnaissance.

• Deploy the Sigma rule below to detect 'kubectl auth can-i' usage on Linux and macOS nodes.
• Review RBAC configurations to ensure that service accounts are strictly limited to the permissions required for their specific function (Least Privilege).
• Implement time-based exceptions for automated CI/CD pipelines or scheduled audit scripts that legitimately use permission verification tools.
• Audit logs from the Kubernetes API server for high-frequency or anomalous 'subjectaccessreviews' requests, which correspond to the 'auth can-i' command.