Kubernetes telemetry sources
Three primary sources: Kubernetes API server audit log (every API call with actor, verb, resource, and outcome), container runtime events (falco or eBPF-based syscall telemetry), and cloud control plane logs (EKS CloudTrail, GKE Admin Activity, AKS Activity Log) for the underlying node identity. All three are required for full attack path coverage.
The API server audit log is the most important single source. Enable it with a policy that captures RequestResponse verbosity for sensitive resources (secrets, rolebindings, clusterrolebindings) and Metadata verbosity for high-volume resources (pods, configmaps). Never disable audit logging — T1562.008 (Impair Defenses) includes disabling Kubernetes audit.
- API server audit policy deployed with RequestResponse for secrets and RBAC resources
- Audit log shipped to a centralised store outside the cluster
- Falco or eBPF runtime telemetry enabled on all node pools
- Cloud control plane logs ingested for node identity (EKS/GKE/AKS)
- ManySignal Kubernetes connector validated with test kubectl command
RBAC and privilege escalation detection
Kubernetes RBAC is the primary access control mechanism and the primary privilege escalation surface. Critical detections: new ClusterRoleBinding granting cluster-admin, new RoleBinding to a service account for a privileged role, pod created with hostPID, hostNetwork, or hostPath volume mounts, and exec into a running pod in a production namespace.
Service account token projection is the preferred authentication method for workloads — but long-lived tokens (the legacy format) are still common and are not subject to automatic rotation. Detect creation of Secrets of type kubernetes.io/service-account-token — these are long-lived credentials that survive pod restarts.
# detections/k8s/cluster_admin_binding.yaml
key: k8s.cluster_admin_binding
domain: container
severity: critical
type: streaming
where:
class_uid: 3005
source: k8s_audit
verb: create
resource: clusterrolebindings
role_ref_name: cluster-admin
outcome: success
attck:
tactic: TA0004
techniques: [T1078.001]
stage: activeRuntime threat detection
API server audit covers intent; runtime telemetry covers execution. Falco rules or eBPF probes detect: shell spawned in a container that doesn't normally exec, sensitive file read (/etc/shadow, /var/run/secrets), network connection to an unexpected external destination, and crypto mining process fingerprints.
Correlating runtime events with API server events is what closes the loop. A kubectl exec followed by a shell spawn followed by an outbound connection to a known C2 range is a high-confidence active compromise sequence. Each event alone might be noise; the sequence on the same pod identity is decisive.
Cloud IAM and node identity
In managed Kubernetes (EKS, GKE, AKS), cluster nodes have cloud IAM identities. A compromised node can use its instance profile or workload identity to call cloud APIs — pivoting from the cluster to the cloud control plane. Monitor the cloud IAM activity of node identities for operations outside their expected scope: a node identity calling IAM CreateUser is a critical signal.
The ManySignal entity graph links Kubernetes workload identities to their underlying cloud IAM identities. An anomalous API call from a cloud identity that backs a Kubernetes node is surfaced in the context of the workloads running on that node — enabling rapid scope determination.
Container image and supply chain monitoring
Admission controllers are the preventive control; audit logs are the detective control. Monitor Kubernetes admission events for pods that use images without a digest pinned (floating tags), images from registries not in the allowlist, and images that fail signature verification.
Image pull events in the API server audit log (imagepullsecrets creation, pod creation with new image references) combined with GHAS container scanning alerts give the earliest signal for a compromised base image before it executes in production.
Key takeaways
- Three required sources: API server audit log, runtime telemetry, cloud control plane logs.
- API server audit log is most important — never disable it; enable RequestResponse verbosity for RBAC and secrets.
- ClusterRoleBinding to cluster-admin and pod exec are the highest-signal RBAC events.
- Runtime telemetry closes the loop — correlate kubectl exec with shell spawn with outbound connection.
- Node IAM identities are pivot points from the cluster to the cloud control plane.
- Prefer eBPF-based runtime probes for lower overhead and higher tamper resistance.