Elastic Security Detection Rules

AWS EKS Potential Endpoint Permission Enumeration Attempt Detected

Last updated 2 days ago on 2026-10-21
Created 3 months ago on 2026-08-03

About

This rule detects potential endpoint enumeration attempts by a single user and source IP address. By looking for a combination of failed/successful API requests across multiple endpoints and a limited number of documents, this rule can detect automated permission enumeration attempts. This behavior is uncommon for regular Kubernetes clusters.
Tags
Domain: CloudDomain: ContainersPlatform: AWSPlatform: KubernetesData Source: AWSData Source: Amazon Web ServicesData Source: Kubernetes API Server Audit LogsService: AWS EKSUse Case: Threat DetectionTactic: DiscoveryRule Type: ES|QLProfile: BetaLanguage: esql
Severity
medium
Risk Score
47
MITRE ATT&CK™

Discovery (TA0007)(external, opens in a new tab or window)

↳ Container and Resource Discovery (T1613)(external, opens in a new tab or window)

License
Elastic License v2(external, opens in a new tab or window)

Definition

Integration Pack
Prebuilt Security Detection Rules
Related Integrations

aws(external, opens in a new tab or window)

Query
text code block:
from logs-aws.eks_audit-* metadata _id, _index, _version
| where aws.eks.audit.stage == "ResponseComplete" and aws.eks.audit.verb in ("get", "list", "watch", "create", "update", "patch")
| stats
  Esql.document_count = count(),
  Esql.kubernetes_audit_annotations_authorization_k8s_io_decision_count_distinct = count_distinct(`aws.eks.audit.annotations.authorization_k8s_io/decision`),
  Esql.kubernetes_audit_verb_count_distinct = count_distinct(aws.eks.audit.verb),
  Esql.kubernetes_audit_requestURI_count_distinct = count_distinct(aws.eks.audit.requestURI),
  Esql.kubernetes_audit_objectRef_resource_count_distinct = count_distinct(aws.eks.audit.objectRef.resource),

  Esql.kubernetes_audit_responseStatus_message_values = values(aws.eks.audit.responseStatus.message),
  Esql.kubernetes_audit_verb_values = values(aws.eks.audit.verb),
  Esql.kubernetes_audit_responseStatus_code_values = values(aws.eks.audit.responseStatus.code),
  Esql.kubernetes_audit_objectRef_resource_values = values(aws.eks.audit.objectRef.resource),
  Esql.kubernetes_audit_objectRef_namespace_values = values(aws.eks.audit.objectRef.namespace),
  Esql.kubernetes_audit_user_username_values = values(aws.eks.audit.user.username),
  Esql.kubernetes_audit_user_groups_values = values(aws.eks.audit.user.groups),
  Esql.kubernetes_audit_requestURI_values = values(aws.eks.audit.requestURI),
  Esql.user_agent_original_values = values(user_agent.original),
  Esql.data_stream_namespace_values = values(data_stream.namespace)

  by aws.eks.audit.user.username, aws.eks.audit.sourceIPs
| where
  Esql.kubernetes_audit_annotations_authorization_k8s_io_decision_count_distinct == 2 and
  Esql.kubernetes_audit_requestURI_count_distinct > 5 and
  Esql.kubernetes_audit_objectRef_resource_count_distinct > 3 and
  Esql.document_count < 75
| keep Esql.*, aws.eks.audit.user.username, aws.eks.audit.sourceIPs

Install detection rules in Elastic Security

Detect AWS EKS Potential Endpoint Permission Enumeration Attempt Detected in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).