Detection of Unauthorized Kubernetes API Interaction via CLI Tools

Adversaries often attempt to interact with Kubernetes environments by directly querying the Kubernetes API server using native command-line tools like curl or wget. This technique allows attackers to evade monitoring associated with legitimate Kubernetes administration tools like kubectl and facilitates the discovery of cluster resources, including pods, deployments, and sensitive configurations such as secrets and config maps. This unauthorized interaction is used for both situational awareness within the target cluster and the direct exfiltration of sensitive material. Detecting these attempts requires visibility into process execution command lines that specifically target sensitive paths within the Kubernetes API. The activity poses a significant risk to the confidentiality and integrity of the containerized environment.

Attack Chain

1. Attacker gains initial execution capability within a container or a host with network access to the internal Kubernetes API.
2. Attacker performs reconnaissance to identify the local network configuration and the address of the Kubernetes API server.
3. Attacker uses a native utility, such as curl or wget, to initiate an HTTP request directed at the Kubernetes API.
4. The request is crafted to target sensitive endpoints such as /api/v1/secrets or /apis/rbac.authorization.k8s.io/.
5. The API server processes the request, potentially returning sensitive configuration data or credentials if authentication is not strictly enforced or if the attacker has obtained a token.
6. Attacker exfiltrates the discovered secrets or metadata back to their infrastructure or uses the discovered information for lateral movement within the cluster.

Impact

Successful exploitation of this technique can lead to the exposure of sensitive cluster secrets, service account tokens, and configuration data. This unauthorized access enables further compromise, including lateral movement, privilege escalation, and potential takeover of cluster-level resources, impacting the security posture of the entire containerized infrastructure.

Recommendation

1. Deploy the provided Sigma rule to detect suspicious process command lines that indicate direct interaction with Kubernetes API endpoints.
2. Baseline authorized tools and scripts (such as CI/CD pipelines or automated health checks) that require access to the API to reduce false positives.
3. Enforce strict Kubernetes RBAC and network policies to restrict internal pod access to the API server.
4. Monitor Kubernetes audit logs for anomalous or unauthorized API requests, correlating them with process execution telemetry on the source host.