Impact

Successful reconnaissance allows an adversary to map the cluster environment, identify high-value targets, and understand RBAC structures, which are critical precursors to privilege escalation or lateral movement within the containerized environment.

Recommendation

• Deploy the provided Elastic ESQL detection rule to identify anomalous multi-resource enumeration in AKS clusters.
• Establish a baseline of legitimate CI/CD, GitOps, and backup operations to exclude expected service account activity and reduce false positives.
• Review the identities (Esql.username) and user agents (Esql.user_agent) identified by this rule for potential credential compromise, especially those involving kubectl.
• Ensure AKS diagnostic logs, specifically the kube-audit category, are correctly routed through Event Hubs to the monitoring environment.