Loading

GKE Suspicious Self-Subject Review via Service Account

Detects GKE service account or node identities invoking self-subject access or rules review APIs. Non-human identities rarely enumerate their own permissions outside known controllers; this can indicate stolen tokens probing effective RBAC.

Rule type: query
Rule indices:

  • logs-gcp.audit-*

Rule Severity: low
Risk Score: 21
Runs every:
Searches indices from: ``
Maximum alerts per execution: 100
References:

Tags:

  • Domain: Cloud
  • Domain: Kubernetes
  • Data Source: GCP
  • Data Source: Google Cloud Platform
  • Use Case: Threat Detection
  • Tactic: Discovery
  • Resources: Investigation Guide

Version: 1
Rule authors:

  • Elastic

Rule license: Elastic License v2

Review the calling service account or node identity and subsequent API activity.

  • Confirm user.email and event.action (selfsubjectaccessreviews or selfsubjectrulesreviews).
  • Correlate with denied requests, secret access, or RBAC changes from the same identity.
  • Known observability or workflow controllers; extend exclusions if needed.

The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule.

data_stream.dataset:gcp.audit and service.name:k8s.io and event.action:(io.k8s.authorization.v1.selfsubjectaccessreviews.create or io.k8s.authorization.v1.selfsubjectrulesreviews.create) and user.email:((system\:node\:* or system\:serviceaccount\:*) and not ("system:serviceaccount:default:argo-argo-workflows-server" or "system:serviceaccount:default:argo-argo-workflows-workflow-controller" or system\:serviceaccount\:*\:datadog-kube-state-metrics))

Framework: MITRE ATT&CK