platform agents, admission webhooks, and ci jobs may legitimately call tokenrequest under non-standard identities. baseline approved automation by client.user.email after validation. expected gke and kube-system controllers are excluded; expand exclusions if additional managed components appear in telemetry.

Techniques

T1552

Sample rules

GKE Service Account Token Created via TokenRequest API

source: elastic
technicques:
- T1552

Description

Detects creation of a GKE service account token through the TokenRequest API by a non-system identity. TokenRequest allows programmatic minting of short-lived tokens for any service account the caller can create tokens for, without reading a mounted projected token from disk. Attackers with initial cluster access can abuse this API to obtain tokens for more privileged service accounts, pivot via Workload Identity to GCP APIs, or retain access after pod termination. Unlike filesystem token theft, TokenRequest activity is visible only in Kubernetes audit logs as create against the serviceaccounts/token subresource.

Detection logic

data_stream.dataset:gcp.audit and service.name:"k8s.io" and event.outcome:success and
event.action:"io.k8s.core.v1.serviceaccounts.token.create" and
client.user.email:(* and not (
  "system:kube-controller-manager" or
  "system:kube-scheduler" or
  "system:gke-controller-manager" or
  "system:gcp-controller-manager" or
  system\:node\:* or
  system\:serviceaccount\:kube-system\:* or
  system\:serviceaccount\:gke-managed-system\:* or
  system\:serviceaccount\:gke-connect\:* or
  system\:serviceaccount\:anthos-identity-service\:*
))