Azure AKS Suspicious Self-Subject Review by Service Account or Node Identity

Last updated 20 days ago on 2026-07-09

Created 20 days ago on 2026-07-09

About

Detects AKS (Azure Kubernetes Service) service account or node identities invoking self-subject access or rules review APIs. Non-human identities rarely enumerate their own permissions outside known controllers; this can indicate stolen tokens probing effective RBAC before privilege escalation.

Tags

Domain: CloudDomain: KubernetesData Source: AzureData Source: Azure Platform LogsData Source: KubernetesUse Case: Threat DetectionTactic: DiscoveryLanguage: kuery

Severity

low

Risk Score

MITRE ATT&CK™

Discovery (TA0007)(external, opens in a new tab or window)

↳ Permission Groups Discovery (T1069)(external, opens in a new tab or window)

↳ Container and Resource Discovery (T1613)(external, opens in a new tab or window)

False Positive Examples

SelfSubjectAccessReview ("can I do X") is routinely issued by controllers checking their own permissions, so busy clusters generate benign volume from platform and add-on service accounts (for example kube-system managed add-ons such as azure-policy, Microsoft Defender, metrics-server, and konnectivity, plus operators like cert-manager, ingress controllers, and Argo/Flux). The rule ships with only the Azure Arc agent accounts (system:serviceaccount:azure-arc:*) excluded; that namespace exists only on Arc-enabled clusters and is one example, not a complete list. Treat the exclusion set as a per-environment denylist: baseline the calling service accounts and add validated platform/observability controllers after review. SelfSubjectRulesReview ("list everything I can do") is far rarer from non-human identities and higher signal. Admin impersonation workflows can also trigger this via an impersonated service account; validate the impersonating user.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: Query (Kibana Query Language)
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: logs-azure.platformlogs-*
Related Integrations: azure(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗data_stream.dataset:azure.platformlogs and
  event.action:Microsoft.ContainerService/managedClusters/diagnosticLogs/Read and
  azure.platformlogs.category:(kube-audit or kube-audit-admin) and
  azure.platformlogs.properties.log.stage:ResponseComplete and
  azure.platformlogs.properties.log.verb:create and
  azure.platformlogs.properties.log.objectRef.resource:(selfsubjectaccessreviews or selfsubjectrulesreviews) and
  azure.platformlogs.properties.log.user.username:((system\:node\:* or system\:serviceaccount\:*) and
  not system\:serviceaccount\:azure-arc\:*)

Install detection rules in Elastic Security

Detect Azure AKS Suspicious Self-Subject Review by Service Account or Node Identity in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).