GKE Service Account Token Created via TokenRequest API

Last updated 9 days ago on 2026-07-13

Created 9 days ago on 2026-07-13

About

Detects creation of a GKE service account token through the TokenRequest API by a non-system identity. TokenRequest allows programmatic minting of short-lived tokens for any service account the caller can create tokens for, without reading a mounted projected token from disk. Attackers with initial cluster access can abuse this API to obtain tokens for more privileged service accounts, pivot via Workload Identity to GCP APIs, or retain access after pod termination. Unlike filesystem token theft, TokenRequest activity is visible only in Kubernetes audit logs as create against the serviceaccounts/token subresource.

Tags

Domain: CloudDomain: KubernetesData Source: GCPData Source: Google Cloud PlatformUse Case: Threat DetectionTactic: Credential AccessLanguage: kuery

Severity

medium

Risk Score

MITRE ATT&CK™

Credential Access (TA0006)(external, opens in a new tab or window)

↳ Unsecured Credentials (T1552)(external, opens in a new tab or window)

False Positive Examples

Platform agents, admission webhooks, and CI jobs may legitimately call TokenRequest under non-standard identities. Baseline approved automation by client.user.email after validation. Expected GKE and kube-system controllers are excluded; expand exclusions if additional managed components appear in telemetry.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: Query (Kibana Query Language)
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: logs-gcp.audit-*
Related Integrations: gcp(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗data_stream.dataset:gcp.audit and service.name:"k8s.io" and event.outcome:success and
event.action:"io.k8s.core.v1.serviceaccounts.token.create" and
client.user.email:(* and not (
  "system:kube-controller-manager" or
  "system:kube-scheduler" or
  "system:gke-controller-manager" or
  "system:gcp-controller-manager" or
  system\:node\:* or
  system\:serviceaccount\:kube-system\:* or
  system\:serviceaccount\:gke-managed-system\:* or
  system\:serviceaccount\:gke-connect\:* or
  system\:serviceaccount\:anthos-identity-service\:*
))

Install detection rules in Elastic Security

Detect GKE Service Account Token Created via TokenRequest API in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).