LoFP LoFP / gcp gke kubernetes cluster

TitleTags
kubectl calls are not malicious by nature. however source ip, source user, user agent, object path, and authorization context can reveal potential malicious activity, specially anonymous suspicious ips and sensitive objects such as configmaps or secrets
not all rbac authorications are malicious. rbac authorizations can uncover malicious activity specially if sensitive roles have been granted.
not all service accounts interactions are malicious. analyst must consider ip, verb and decision context when trying to detect maliciousness.
sensitive object access is not necessarily malicious but user and object context can provide guidance for detection.
this search can give false positives as there might be inherent issues with authentications and permissions at cluster.