Kubernetes Long-Lived Service Account Token Created

Description

Detects the creation of long-lived service account tokens via the serviceaccounts/token subresource. Kubernetes 1.24+ deprecated automatic token creation, but users with appropriate permissions can still manually create non-expiring tokens for service accounts. Attackers can abuse this to establish persistent access credentials that don't expire automatically. This technique is documented by Stratus Red Team as a persistence mechanism. Note: GCP GKE does not log TokenRequest API operations in Kubernetes audit logs.

Query · python

from panther_kubernetes_helpers import (
    is_failed_request,
    is_system_namespace,
    is_system_principal,
    k8s_alert_context,
)


def rule(event):
    verb = event.udm("verb")
    resource = event.udm("resource")
    subresource = event.udm("subresource")
    namespace = event.udm("namespace")
    username = event.udm("username")
    response_status = event.udm("responseStatus")

    # Only check serviceaccount token subresource creation
    if verb != "create" or resource != "serviceaccounts" or subresource != "token":
        return False

    # Skip failed requests
    if is_failed_request(response_status):
        return False

    # Exclude system principals in system namespaces (legitimate operations)
    # but alert on system principals in user namespaces (malicious controllers)
    # and alert on users creating tokens in system namespaces (privilege escalation)
    if is_system_principal(username) and is_system_namespace(namespace):
        return False

    return True


def title(event):
    username = event.udm("username") or "<UNKNOWN_USER>"
    namespace = event.udm("namespace") or "<UNKNOWN_NAMESPACE>"
    name = event.udm("name") or "<UNKNOWN_SA>"

    return f"[{username}] created long-lived token for service account " f"[{namespace}/{name}]"


def dedup(event):
    username = event.udm("username") or "<UNKNOWN_USER>"
    namespace = event.udm("namespace") or "<UNKNOWN_NAMESPACE>"
    name = event.udm("name") or "<UNKNOWN_SA>"
    return f"k8s_token_created_{username}_{namespace}_{name}"


def alert_context(event):
    return k8s_alert_context(
        event,
        extra_fields={
            "service_account": event.udm("name"),
            "namespace": event.udm("namespace"),
            "subresource": "token",
        },
    )

Analyst notes

  1. Immediately investigate the user creating the token and determine if they have a legitimate need for long-lived credentials
  2. Review the service account permissions to assess what access the token provides by checking RoleBindings and ClusterRoleBindings
  3. Search for API activity using this service account in the past 24 hours to identify any unauthorized operations
Raw source Kubernetes Long-Lived Service Account Token Created · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: rule
RuleID: "Kubernetes.ServiceAccount.TokenCreated"
DisplayName: "Kubernetes Long-Lived Service Account Token Created"
Enabled: true
Status: Experimental
Filename: k8s_serviceaccount_token_created.py
LogTypes:
  - Amazon.EKS.Audit
  - Azure.MonitorActivity
Tags:
  - Kubernetes
  - Persistence
  - Credential Access
Severity: Info
Description: >
  Detects the creation of long-lived service account tokens via the serviceaccounts/token subresource. Kubernetes 1.24+
  deprecated automatic token creation, but users with appropriate permissions can still manually create non-expiring tokens
  for service accounts. Attackers can abuse this to establish persistent access credentials that don't expire automatically.
  This technique is documented by Stratus Red Team as a persistence mechanism.
  Note: GCP GKE does not log TokenRequest API operations in Kubernetes audit logs.
Runbook: |
  1. Immediately investigate the user creating the token and determine if they have a legitimate need for long-lived credentials
  2. Review the service account permissions to assess what access the token provides by checking RoleBindings and ClusterRoleBindings
  3. Search for API activity using this service account in the past 24 hours to identify any unauthorized operations
Reports:
  Stratus Red Team:
    - k8s.persistence.create-token
  MITRE ATT&CK:
    - TA0003:T1098 # Persistence: Account Manipulation
    - TA0006:T1552 # Credential Access: Unsecured Credentials
Reference: https://stratus-red-team.cloud/attack-techniques/kubernetes/k8s.persistence.create-token/
DedupPeriodMinutes: 60
SummaryAttributes:
  - username
  - namespace
  - name
  - p_source_label
Tests:
  - Name: EKS long-lived token created
    ExpectedResult: true
    Log:
      {
        "kind": "Event",
        "apiVersion": "audit.k8s.io/v1",
        "verb": "create",
        "user": {"username": "attacker@example.com"},
        "sourceIPs": ["203.0.113.42"],
        "userAgent": "kubectl/v1.28.0",
        "objectRef": {
          "resource": "serviceaccounts",
          "subresource": "token",
          "namespace": "production",
          "name": "persistence-sa",
          "apiVersion": "v1"
        },
        "responseStatus": {"code": 201},
        "p_log_type": "Amazon.EKS.Audit",
        "p_source_label": "eks-cluster"
      }
  - Name: AKS long-lived token created
    ExpectedResult: true
    Log:
      {
        "p_log_type": "Azure.MonitorActivity",
        "category": "kube-audit",
        "operationName": "Microsoft.ContainerService/managedClusters/diagnosticLogs/Read",
        "properties": {
          "log": "{\"kind\":\"Event\",\"apiVersion\":\"audit.k8s.io/v1\",\"verb\":\"create\",\"user\":{\"username\":\"persistence-user@example.com\"},\"sourceIPs\":[\"1.2.3.4\"],\"objectRef\":{\"resource\":\"serviceaccounts\",\"subresource\":\"token\",\"namespace\":\"default\",\"name\":\"backdoor-sa\",\"apiVersion\":\"v1\"},\"responseStatus\":{\"code\":201}}"
        },
        "p_source_label": "aks-cluster"
      }
  - Name: Token created in default namespace
    ExpectedResult: true
    Log:
      {
        "kind": "Event",
        "verb": "create",
        "user": {"username": "attacker@example.com"},
        "objectRef": {
          "resource": "serviceaccounts",
          "subresource": "token",
          "namespace": "default",
          "name": "attacker-sa"
        },
        "responseStatus": {"code": 201},
        "p_log_type": "Amazon.EKS.Audit",
        "p_source_label": "eks-cluster"
      }
  - Name: User creating token in system namespace (alert)
    ExpectedResult: true
    Log:
      {
        "kind": "Event",
        "verb": "create",
        "user": {"username": "admin@example.com"},
        "objectRef": {
          "resource": "serviceaccounts",
          "subresource": "token",
          "namespace": "kube-system",
          "name": "escalation-sa"
        },
        "responseStatus": {"code": 201},
        "p_log_type": "Amazon.EKS.Audit"
      }
  - Name: System principal in user namespace (alert)
    ExpectedResult: true
    Log:
      {
        "kind": "Event",
        "verb": "create",
        "user": {"username": "system:kube-controller-manager"},
        "objectRef": {
          "resource": "serviceaccounts",
          "subresource": "token",
          "namespace": "production",
          "name": "app-sa"
        },
        "responseStatus": {"code": 201},
        "p_log_type": "Amazon.EKS.Audit"
      }
  - Name: System principal in system namespace (excluded)
    ExpectedResult: false
    Log:
      {
        "kind": "Event",
        "verb": "create",
        "user": {"username": "system:kube-controller-manager"},
        "objectRef": {
          "resource": "serviceaccounts",
          "subresource": "token",
          "namespace": "kube-system",
          "name": "legitimate-sa"
        },
        "responseStatus": {"code": 201},
        "p_log_type": "Amazon.EKS.Audit"
      }
  - Name: Failed token creation (excluded)
    ExpectedResult: false
    Log:
      {
        "kind": "Event",
        "verb": "create",
        "user": {"username": "attacker@example.com"},
        "objectRef": {
          "resource": "serviceaccounts",
          "subresource": "token",
          "namespace": "production",
          "name": "denied-sa"
        },
        "responseStatus": {"code": 403},
        "p_log_type": "Amazon.EKS.Audit"
      }
  - Name: Service account creation (not token)
    ExpectedResult: false
    Log:
      {
        "kind": "Event",
        "verb": "create",
        "user": {"username": "admin@example.com"},
        "objectRef": {
          "resource": "serviceaccounts",
          "namespace": "production",
          "name": "new-sa"
        },
        "responseStatus": {"code": 201},
        "p_log_type": "Amazon.EKS.Audit"
      }
  - Name: Get service account (not create)
    ExpectedResult: false
    Log:
      {
        "kind": "Event",
        "verb": "get",
        "user": {"username": "admin@example.com"},
        "objectRef": {
          "resource": "serviceaccounts",
          "subresource": "token",
          "namespace": "production",
          "name": "existing-sa"
        },
        "responseStatus": {"code": 200},
        "p_log_type": "Amazon.EKS.Audit"
      }

# ------ paired body: k8s_serviceaccount_token_created.py ------

from panther_kubernetes_helpers import (
    is_failed_request,
    is_system_namespace,
    is_system_principal,
    k8s_alert_context,
)


def rule(event):
    verb = event.udm("verb")
    resource = event.udm("resource")
    subresource = event.udm("subresource")
    namespace = event.udm("namespace")
    username = event.udm("username")
    response_status = event.udm("responseStatus")

    # Only check serviceaccount token subresource creation
    if verb != "create" or resource != "serviceaccounts" or subresource != "token":
        return False

    # Skip failed requests
    if is_failed_request(response_status):
        return False

    # Exclude system principals in system namespaces (legitimate operations)
    # but alert on system principals in user namespaces (malicious controllers)
    # and alert on users creating tokens in system namespaces (privilege escalation)
    if is_system_principal(username) and is_system_namespace(namespace):
        return False

    return True


def title(event):
    username = event.udm("username") or "<UNKNOWN_USER>"
    namespace = event.udm("namespace") or "<UNKNOWN_NAMESPACE>"
    name = event.udm("name") or "<UNKNOWN_SA>"

    return f"[{username}] created long-lived token for service account " f"[{namespace}/{name}]"


def dedup(event):
    username = event.udm("username") or "<UNKNOWN_USER>"
    namespace = event.udm("namespace") or "<UNKNOWN_NAMESPACE>"
    name = event.udm("name") or "<UNKNOWN_SA>"
    return f"k8s_token_created_{username}_{namespace}_{name}"


def alert_context(event):
    return k8s_alert_context(
        event,
        extra_fields={
            "service_account": event.udm("name"),
            "namespace": event.udm("namespace"),
            "subresource": "token",
        },
    )

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.