Skip to content
Threat Feed
Subscribe
low advisory

AWS EKS: Suspicious Self-Subject Review via Unusual User Agent

This rule detects when a service account or node enumerates its own permissions via the selfsubjectaccessreview or selfsubjectrulesreview APIs using an unusual user agent, which may indicate compromised credentials.

Triage facts

Revision 1
Evidence
Unknown
Severity
Low
Sources
3 public sources
Freshness
Revision 1Oct 21, 08:30 UTC
Source quality
B2Roughly even chance

Adversaries who have gained access to service account or node credentials may attempt to determine their privileges to facilitate further movement or execution within the cluster. Kubernetes APIs such as selfsubjectaccessreview and selfsubjectrulesreview are intended for permission debugging but can be exploited for privilege enumeration. This detection identifies these API calls when performed by service accounts or nodes using non-standard user agents.

False Positives

  • Automated tasks or service accounts programmed to perform routine permission checks.
  • Nodes performing legitimate self-assessment for compliance or security.
  • Development or testing environments with frequent permission verification.

Investigation

  • Identify the service account or node using aws.eks.audit.user.username or aws.eks.audit.impersonatedUser.username.
  • Analyze the aws.eks.audit.objectRef.resource to confirm the API call type.
  • Evaluate the IP address and user agent in the audit logs against expected traffic patterns.
  • Review recent changes to permissions or roles associated with the implicated identity.