elastic-detection-rules

mirror of https://github.com/elastic/detection-rules synced 2026-06-08 14:00:08 +00:00

Files

T

Samirbous 0901ec10af [New] Kubernetes API Request Impersonating Privileged Identity (#6085 )

* [New] Kubernetes API Request Impersonating Privileged Identity

Detects Kubernetes API requests where a user is impersonating a privileged cluster identity such as system:kube-controller-manager, system:admin, system:anonymous, or a member of the system:masters group. These identities have broad cluster-wide permissions including unrestricted access to all secrets, the ability to create tokens for any service account, schedule pods on any node, and modify RBAC policies.

* Update privilege_escalation_kubernetes_api_request_impersonating_privileged_identity.toml

* Update rules/integrations/kubernetes/privilege_escalation_kubernetes_api_request_impersonating_privileged_identity.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

---------

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

(cherry picked from commit 9bd94c62a5)

2026-05-18 11:28:10 +00:00

aws

[New] EKS Access Entry Granted Cluster Admin Policy (#6091 )

2026-05-14 15:50:29 +00:00

aws_bedrock

[Tuning] Add mv_expand for gen_ai.policy.action field (#5296 )

2025-11-11 07:37:40 +05:30

azure

[New] Entra ID Register Device with Unusual User Agent (#6151 )

2026-05-18 10:57:41 +00:00

azure_openai

[Rule Tuning] Updated ESQL Rules Based on Validation Results (#5151 )