Skip to content
Threat Feed
Subscribe

Product

Elastic Kubernetes Service (EKS)

3 briefs RSS
high advisory

Amazon EKS: Improper TokenRequest API usage detection

Attackers can abuse the Kubernetes TokenRequest API to mint service account tokens without filesystem access, facilitating privilege escalation and movement to cloud resources via IAM Roles for Service Accounts (IRSA).

Elastic Kubernetes Service cloud kubernetes aws eks credential-access reconnaissance discovery execution +6
2r 11t updated
medium advisory

Abuse of Kubernetes TokenRequest API for Credential Access

Attackers with initial cluster access are abusing the Kubernetes TokenRequest API to mint arbitrary service account tokens, facilitating privilege escalation, cloud resource pivoting, and persistence without leaving filesystem artifacts.

Elastic Kubernetes Service +3 credential-access kubernetes cloud-security audit-logs
1r 1t
medium advisory

Monitoring Unauthorized Amazon EKS Access Entry Modifications

Detection of unauthorized Amazon EKS Access Entry modifications via AWS CloudTrail, which may be used by attackers to achieve persistent access or privilege escalation in Kubernetes clusters.

Elastic Kubernetes Service cloud kubernetes persistence privilege-escalation aws
1r 1t