some controllers and admin impersonation workflows legitimately submit self-subject reviews. excluded identities include common argo and datadog service accounts.

t1069
t1613
gcp
elastic

Techniques

T1069
T1613

Sample rules

GKE Suspicious Self-Subject Review via Service Account

source: elastic
technicques:
- T1069
- T1613

Description

Detects GKE service account or node identities invoking self-subject access or rules review APIs. Non-human identities rarely enumerate their own permissions outside known controllers; this can indicate stolen tokens probing effective RBAC.

Detection logic

data_stream.dataset:gcp.audit and service.name:k8s.io and event.action:(io.k8s.authorization.v1.selfsubjectaccessreviews.create or io.k8s.authorization.v1.selfsubjectrulesreviews.create) and user.email:((system\:node\:* or system\:serviceaccount\:*) and not ("system:serviceaccount:default:argo-argo-workflows-server" or "system:serviceaccount:default:argo-argo-workflows-workflow-controller" or system\:serviceaccount\:*\:datadog-kube-state-metrics))