Product
AWS EKS Control Plane Logging Disabled
2 rules 1 TTPThis rule detects successful Amazon EKS UpdateClusterConfig requests that disable control plane logging, potentially indicating defense evasion via compromised AWS credentials or unauthorized administrative access that reduces visibility into cluster activity.
AWS EKS Access Entry Granted Cluster Admin Policy
2 rules 2 TTPsDetects when the AmazonEKSClusterAdminPolicy or AmazonEKSAdminPolicy is associated with a principal via the EKS Access Entries API, effectively granting full cluster-admin access and enabling potential privilege escalation and persistence.
AWS EKS Access Entry Modification Detected
2 rules 2 TTPsSuccessful Amazon EKS Access Entries API operations that create, update, attach, detach, or delete authentication mappings between IAM principals and the cluster, potentially indicating persistence or privilege escalation are detected.
EKS Authentication Configuration Modified
2 rules 2 TTPsThis rule detects modifications to the aws-auth ConfigMap in Amazon EKS clusters, enabling attackers to grant cluster-admin access by mapping AWS IAM roles to the system:masters group, achieving persistence and privilege escalation.
Suspicious Process Accessing Sensitive Identity Files via Auditd
3 rules 2 TTPsThis rule detects suspicious processes, such as copy utilities or scripting tools, accessing sensitive identity files on Linux systems, including Kubernetes tokens, cloud CLI configurations, and root SSH keys, indicating potential credential theft.
AWS AssumeRoleWithWebIdentity from Kubernetes SA and External ASN
2 rules 1 TTPDetects successful AWS `AssumeRoleWithWebIdentity` calls where the caller identity is a Kubernetes service account and the source autonomous system organization is not `Amazon.com, Inc.`, which may indicate a stolen or misused projected service-account token being exchanged for IAM credentials off-cluster.