From bfba18f3b06db27697faa65730f6be67351018ed Mon Sep 17 00:00:00 2001 From: bryans3c Date: Fri, 14 Aug 2026 17:58:04 +0200 Subject: [PATCH 1/6] [New Rule] AWS EKS Access Entry Created Then Deleted by Same Identity --- ...eks_access_entry_granted_then_deleted.toml | 112 ++++++++++++++++++ 1 file changed, 112 insertions(+) create mode 100644 rules/integrations/aws/persistence_eks_access_entry_granted_then_deleted.toml diff --git a/rules/integrations/aws/persistence_eks_access_entry_granted_then_deleted.toml b/rules/integrations/aws/persistence_eks_access_entry_granted_then_deleted.toml new file mode 100644 index 00000000000..824d38f5c85 --- /dev/null +++ b/rules/integrations/aws/persistence_eks_access_entry_granted_then_deleted.toml @@ -0,0 +1,112 @@ +[metadata] +creation_date = "2026/08/14" +integration = ["aws"] +maturity = "production" +updated_date = "2026/08/14" + +[rule] +author = ["Elastic"] +description = """ +Detects the creation of an Amazon EKS access entry followed by its deletion by the same +identity within a short time window. EKS access entries define Kubernetes RBAC-level +permissions for IAM principals in an EKS cluster. An adversary with EKS administrative +access may temporarily grant themselves cluster access, use those permissions to create +Kubernetes RBAC resources (ClusterRoleBindings, ServiceAccounts with privileged roles), +and then delete the access entry to hide the evidence of the initial grant while retaining +access through the Kubernetes-level backdoor. +""" +false_positives = [ + """ + Automated infrastructure tests that create and immediately tear down EKS access entries + as part of CI/CD validation may trigger this rule. Validate that the sequence corresponds + to a documented test pipeline. + """, +] +from = "now-6m" +index = ["logs-aws.cloudtrail-*"] +interval = "5m" +language = "eql" +license = "Elastic License v2" +name = "AWS EKS Access Entry Created Then Deleted by Same Identity" +note = """## Triage and analysis + +### Investigating AWS EKS Access Entry Created Then Deleted by Same Identity + +EKS access entries (introduced in EKS API mode) map IAM principals to Kubernetes access policies or allow associating Kubernetes groups to IAM principals. An adversary who obtains `eks:CreateAccessEntry` and `eks:DeleteAccessEntry` permissions can: + +1. Create an access entry for their own IAM principal with cluster-admin level access. +2. Use that access to create persistent Kubernetes RBAC resources (ClusterRoleBindings, privileged ServiceAccounts, rogue DaemonSets). +3. Delete the access entry, removing the CloudTrail evidence of the initial grant while retaining Kubernetes-level access. + +This sequence is analogous to adding a backdoor user, using it, then deleting it to cover tracks. The deletion within a short window of creation is the key behavioral indicator. + +### Possible investigation steps + +- Identify the calling identity from `aws.cloudtrail.user_identity.arn` and the targeted cluster from `aws.cloudtrail.request_parameters`. +- Review Kubernetes audit logs for the affected cluster in the time window between the `CreateAccessEntry` and `DeleteAccessEntry` events. Look for `create` verbs on ClusterRoleBindings, RoleBindings, ServiceAccounts, or DaemonSets. +- Check the cluster's current RBAC configuration for persistent backdoor resources. +- Determine whether the identity had a legitimate reason to create an access entry for the targeted cluster. + +### Response and remediation + +- Audit all Kubernetes RBAC resources for unauthorized ClusterRoleBindings or privileged ServiceAccounts created in the suspect window. +- Rotate credentials for the calling identity. +- Apply IAM policies restricting `eks:CreateAccessEntry` and `eks:DeleteAccessEntry` to designated EKS administrative roles. +""" +references = [ + "https://docs.aws.amazon.com/eks/latest/APIReference/API_CreateAccessEntry.html", + "https://docs.aws.amazon.com/eks/latest/APIReference/API_DeleteAccessEntry.html", + "https://www.wiz.io/blog/new-attack-vectors-emerge-via-recent-eks-access-entries-and-pod-identity-features", + "https://securitylabs.datadoghq.com/articles/eks-cluster-access-management-deep-dive/", +] +risk_score = 73 +rule_id = "2b60fb61-d0c7-405e-9f33-a66d8729628d" +setup = "The AWS integration must be ingesting management events into `logs-aws.cloudtrail-*`. EKS management events are logged by default." +severity = "high" +tags = [ + "Domain: Cloud", + "Platform: AWS", + "Data Source: AWS CloudTrail", + "Service: AWS EKS", + "Rule Type: Event Correlation (EQL)", + "Tactic: Persistence", + "Resources: Investigation Guide", +] +timestamp_override = "event.ingested" +type = "eql" + +query = ''' +sequence by user.name with maxspan=10m + [any where event.provider == "eks.amazonaws.com" and event.action == "CreateAccessEntry" and event.outcome == "success"] + [any where event.provider == "eks.amazonaws.com" and event.action == "DeleteAccessEntry" and event.outcome == "success"] +''' + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1136" +name = "Create Account" +reference = "https://attack.mitre.org/techniques/T1136/" +[[rule.threat.technique.subtechnique]] +id = "T1136.003" +name = "Cloud Account" +reference = "https://attack.mitre.org/techniques/T1136/003/" + +[rule.threat.tactic] +id = "TA0003" +name = "Persistence" +reference = "https://attack.mitre.org/tactics/TA0003/" + +[rule.investigation_fields] +field_names = [ + "@timestamp", + "aws.cloudtrail.user_identity.arn", + "aws.cloudtrail.user_identity.type", + "user.name", + "event.action", + "event.outcome", + "aws.cloudtrail.request_parameters", + "source.ip", + "cloud.region", + "cloud.account.id", +] From f54a7bc8ed13953f67a3db5e4228d2b6d1f09bd4 Mon Sep 17 00:00:00 2001 From: Bryan Porras Date: Fri, 14 Aug 2026 19:27:38 +0200 Subject: [PATCH 2/6] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- ...stence_eks_access_entry_granted_then_deleted.toml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/rules/integrations/aws/persistence_eks_access_entry_granted_then_deleted.toml b/rules/integrations/aws/persistence_eks_access_entry_granted_then_deleted.toml index 824d38f5c85..bfe8f0428b7 100644 --- a/rules/integrations/aws/persistence_eks_access_entry_granted_then_deleted.toml +++ b/rules/integrations/aws/persistence_eks_access_entry_granted_then_deleted.toml @@ -84,13 +84,13 @@ sequence by user.name with maxspan=10m [[rule.threat]] framework = "MITRE ATT&CK" [[rule.threat.technique]] -id = "T1136" -name = "Create Account" -reference = "https://attack.mitre.org/techniques/T1136/" +id = "T1098" +name = "Account Manipulation" +reference = "https://attack.mitre.org/techniques/T1098/" [[rule.threat.technique.subtechnique]] -id = "T1136.003" -name = "Cloud Account" -reference = "https://attack.mitre.org/techniques/T1136/003/" +id = "T1098.006" +name = "Additional Container Cluster Roles" +reference = "https://attack.mitre.org/techniques/T1098/006/" [rule.threat.tactic] id = "TA0003" From df762b0efddca324b67fac3deb90620d7a579f90 Mon Sep 17 00:00:00 2001 From: Bryan Porras Date: Fri, 14 Aug 2026 19:27:54 +0200 Subject: [PATCH 3/6] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .../aws/persistence_eks_access_entry_granted_then_deleted.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/integrations/aws/persistence_eks_access_entry_granted_then_deleted.toml b/rules/integrations/aws/persistence_eks_access_entry_granted_then_deleted.toml index bfe8f0428b7..6d7bc9b450d 100644 --- a/rules/integrations/aws/persistence_eks_access_entry_granted_then_deleted.toml +++ b/rules/integrations/aws/persistence_eks_access_entry_granted_then_deleted.toml @@ -22,7 +22,7 @@ false_positives = [ to a documented test pipeline. """, ] -from = "now-6m" +from = "now-15m" index = ["logs-aws.cloudtrail-*"] interval = "5m" language = "eql" From d084475c2838d86e89d1d9848033a2d50816cf8f Mon Sep 17 00:00:00 2001 From: Bryan Porras Date: Wed, 26 Aug 2026 09:56:22 +0200 Subject: [PATCH 4/6] Apply suggestions from code review Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> --- ...tence_eks_access_entry_granted_then_deleted.toml | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/rules/integrations/aws/persistence_eks_access_entry_granted_then_deleted.toml b/rules/integrations/aws/persistence_eks_access_entry_granted_then_deleted.toml index 6d7bc9b450d..ca7609a6af3 100644 --- a/rules/integrations/aws/persistence_eks_access_entry_granted_then_deleted.toml +++ b/rules/integrations/aws/persistence_eks_access_entry_granted_then_deleted.toml @@ -24,7 +24,6 @@ false_positives = [ ] from = "now-15m" index = ["logs-aws.cloudtrail-*"] -interval = "5m" language = "eql" license = "Elastic License v2" name = "AWS EKS Access Entry Created Then Deleted by Same Identity" @@ -59,13 +58,15 @@ references = [ "https://www.wiz.io/blog/new-attack-vectors-emerge-via-recent-eks-access-entries-and-pod-identity-features", "https://securitylabs.datadoghq.com/articles/eks-cluster-access-management-deep-dive/", ] -risk_score = 73 +risk_score = 47 rule_id = "2b60fb61-d0c7-405e-9f33-a66d8729628d" setup = "The AWS integration must be ingesting management events into `logs-aws.cloudtrail-*`. EKS management events are logged by default." -severity = "high" +severity = "medium" tags = [ "Domain: Cloud", + "Domain: Kubernetes", "Platform: AWS", + "Platform: Kubernetes", "Data Source: AWS CloudTrail", "Service: AWS EKS", "Rule Type: Event Correlation (EQL)", @@ -76,9 +77,9 @@ timestamp_override = "event.ingested" type = "eql" query = ''' -sequence by user.name with maxspan=10m - [any where event.provider == "eks.amazonaws.com" and event.action == "CreateAccessEntry" and event.outcome == "success"] - [any where event.provider == "eks.amazonaws.com" and event.action == "DeleteAccessEntry" and event.outcome == "success"] +sequence by aws.cloudtrail.user_identity.arn with maxspan=10m + [any where data_stream.dataset == "aws.cloudtrail" and event.provider == "eks.amazonaws.com" and event.action == "CreateAccessEntry" and event.outcome == "success" and aws.cloudtrail.user_identity.arn != null] + [any where data_stream.dataset == "aws.cloudtrail" and event.provider == "eks.amazonaws.com" and event.action == "DeleteAccessEntry" and event.outcome == "success" and aws.cloudtrail.user_identity.arn != null] ''' [[rule.threat]] From 2366c5bed2dc64884a715f9f484b7449447a3210 Mon Sep 17 00:00:00 2001 From: Bryan Porras Date: Wed, 26 Aug 2026 09:56:51 +0200 Subject: [PATCH 5/6] Update persistence_eks_access_entry_granted_then_deleted.toml --- .../aws/persistence_eks_access_entry_granted_then_deleted.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/integrations/aws/persistence_eks_access_entry_granted_then_deleted.toml b/rules/integrations/aws/persistence_eks_access_entry_granted_then_deleted.toml index ca7609a6af3..e548420f113 100644 --- a/rules/integrations/aws/persistence_eks_access_entry_granted_then_deleted.toml +++ b/rules/integrations/aws/persistence_eks_access_entry_granted_then_deleted.toml @@ -77,7 +77,7 @@ timestamp_override = "event.ingested" type = "eql" query = ''' -sequence by aws.cloudtrail.user_identity.arn with maxspan=10m +sequence by aws.cloudtrail.user_identity.arn with maxspan=5m [any where data_stream.dataset == "aws.cloudtrail" and event.provider == "eks.amazonaws.com" and event.action == "CreateAccessEntry" and event.outcome == "success" and aws.cloudtrail.user_identity.arn != null] [any where data_stream.dataset == "aws.cloudtrail" and event.provider == "eks.amazonaws.com" and event.action == "DeleteAccessEntry" and event.outcome == "success" and aws.cloudtrail.user_identity.arn != null] ''' From 14d8e10a4c773a5916baf4b7db8ba13c60c31082 Mon Sep 17 00:00:00 2001 From: Bryan Porras Date: Wed, 26 Aug 2026 10:15:41 +0200 Subject: [PATCH 6/6] Enhance EKS access entry documentation with false positive analysis Added false positive analysis section to clarify scenarios that may trigger EKS access entry events. --- ...persistence_eks_access_entry_granted_then_deleted.toml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/rules/integrations/aws/persistence_eks_access_entry_granted_then_deleted.toml b/rules/integrations/aws/persistence_eks_access_entry_granted_then_deleted.toml index e548420f113..6752a4ac228 100644 --- a/rules/integrations/aws/persistence_eks_access_entry_granted_then_deleted.toml +++ b/rules/integrations/aws/persistence_eks_access_entry_granted_then_deleted.toml @@ -46,6 +46,14 @@ This sequence is analogous to adding a backdoor user, using it, then deleting it - Check the cluster's current RBAC configuration for persistent backdoor resources. - Determine whether the identity had a legitimate reason to create an access entry for the targeted cluster. +### False positive analysis + +- Infrastructure-as-code and CI/CD pipelines that create and tear down EKS access entries as part of cluster validation — Terraform or eksctl apply/destroy cycles, ephemeral test clusters — will produce this exact sequence. Correlate with the pipeline identity and change records before triaging further. +- Short-lived break-glass or just-in-time administrative access that is granted and revoked by the same operator within minutes is legitimate; confirm against access-request tickets or change approvals. +- Migration tooling that switches clusters between authentication modes may churn access entries in bulk under a single automation role. +- The sequence correlates on the calling identity only, so confirm the `CreateAccessEntry` and `DeleteAccessEntry` events reference the same cluster and principal ARN in the request parameters before treating them as one grant-and-revoke cycle. +- Scope any exceptions by the calling ARN or automation role rather than excluding the behavior globally. + ### Response and remediation - Audit all Kubernetes RBAC resources for unauthorized ClusterRoleBindings or privileged ServiceAccounts created in the suspect window.