LoFP LoFP / built-in controller service accounts are rarely assigned to running pods. false positives should be rare; allowlist documented platform automation by actor when baselined.

Techniques

Sample rules

GKE Suspicious Assignment of Controller Service Account

Description

Detects a request to attach a built-in kube-controller-manager service account to a pod running in the kube-system namespace on GKE. These service accounts are admin-equivalent and are not normally assigned to arbitrary pods. An attacker who can create pods in kube-system can abuse these tokens for cluster-wide privilege escalation.

Detection logic

data_stream.dataset:gcp.audit and service.name:"k8s.io" and event.outcome:success and
event.action:"io.k8s.core.v1.pods.create" and gcp.audit.request.metadata.namespace:"kube-system" and
gcp.audit.request.spec.serviceAccountName:(
  attachdetach-controller or certificate-controller or cloud-provider or
  clusterrole-aggregation-controller or cronjob-controller or daemon-set-controller or deployment-controller or
  disruption-controller or endpoint-controller or expand-controller or generic-garbage-collector or
  horizontal-pod-autoscaler or job-controller or namespace-controller or node-controller or
  persistent-volume-binder or pod-garbage-collector or pv-protection-controller or pvc-protection-controller or
  replicaset-controller or replication-controller or resourcequota-controller or root-ca-cert-publisher or
  route-controller or service-account-controller or service-controller or statefulset-controller or ttl-controller
)