EKS Anonymous API Access Detected

Description

This rule detects anonymous API requests made to the Kubernetes API server. In production environments, anonymous access should be disabled to prevent unauthorized access to the API server.

Query · python

from ipaddress import ip_address

from panther_aws_helpers import eks_panther_obj_ref


def rule(event):
    src_ip = event.get("sourceIPs", ["0.0.0.0"])  # nosec
    if src_ip == ["127.0.0.1"]:
        return False
    if event.get("userAgent", "") == "ELB-HealthChecker/2.0":
        try:
            if ip_address(src_ip[0]).is_private:
                return False
        except ValueError:
            pass

    # Check if the username is set to "system:anonymous", which indicates anonymous access
    if event.deep_get("user", "username") == "system:anonymous":
        return True
    return False


def title(event):
    # For INFO-level events, just group them all together since they're not that interesting
    if event.deep_get("annotations", "authorization.k8s.io/decision") != "allow":
        return "Failed Anonymous EKS Access Attempt(s) Detected"
    if event.get("requestURI") == "/version":
        return "Anonymous EKS Access to /version Endpoint Detected"
    p_eks = eks_panther_obj_ref(event)
    return (
        f"Anonymous API access detected on Kubernetes API server "
        f"from [{p_eks.get('sourceIPs')[0]}] to [{event.get('requestURI', 'NO_URI')}] "
        f"on [{p_eks.get('p_source_label')}]"
    )


def severity(event):
    if event.deep_get("annotations", "authorization.k8s.io/decision") != "allow":
        return "INFO"
    if event.get("requestURI") == "/version":
        return "INFO"
    return "DEFAULT"


def dedup(event):
    # For INFO-level events, just group them all together since they're not that interesting
    if severity(event) == "INFO":
        return "no dedup"
    p_eks = eks_panther_obj_ref(event)
    return f"anonymous_access_{p_eks.get('p_source_label')}_{event.get('userAgent')}"


def alert_context(event):
    p_eks = eks_panther_obj_ref(event)
    mutable_event = event.to_dict()
    mutable_event["p_eks"] = p_eks
    return dict(mutable_event)

Analyst notes

Check the EKS cluster configuration and ensure that anonymous access to the Kubernetes API server is disabled. This can be done by verifying the API server arguments and authentication webhook configuration.

Detection tier

Atomic IOCs
Network & Host Artifacts
Tools
TTPs
Pending classification

Metadata

Source: panther-labs/panther-analysis
License: Apache 2.0
Severity: Low
Status: Stable
Query type: python
Created: 2024-11-04
Modified: 2026-06-11
Authored by: panther-labs
Source ID
Upstream: rules/aws_eks_rules/anonymous_api_access.yml
Type: rule
Version: 4
References: https://raesene.github.io/blog/2023/03/18/lets-talk-about-anonymous-access-to-Kubernetes/
Data sources: Amazon.EKS.Audit

ATT&CK

TA0001 T1190