Azure Kubernetes Service: Multi-resource discovery detection

This rule monitors Azure Kubernetes Service (AKS) kube-audit logs to identify reconnaissance behavior. It specifically tracks identities that access multiple Kubernetes API resource types - such as namespaces, nodes, pods, roles, clusterroles, configmaps, serviceaccounts, rolebindings, and clusterrolebindings - within a single window. By focusing on the cardinality of unique resources accessed, the logic differentiates cluster orientation and reconnaissance from steady-state controllers or platform-managed identities.

Impact

Successful reconnaissance allows an adversary to map the cluster environment, identify high-value targets, and understand RBAC structures, which are critical precursors to privilege escalation or lateral movement within the containerized environment.

Recommendation

• Deploy the provided Elastic ESQL detection rule to identify anomalous multi-resource enumeration in AKS clusters.
• Establish a baseline of legitimate CI/CD, GitOps, and backup operations to exclude expected service account activity and reduce false positives.
• Review the identities (Esql.username) and user agents (Esql.user_agent) identified by this rule for potential credential compromise, especially those involving kubectl.
• Ensure AKS diagnostic logs, specifically the kube-audit category, are correctly routed through Event Hubs to the monitoring environment.