Elastic Security Detection Rules

Kubeconfig File Creation or Modification

Last updated 7 days ago on 2025-06-17
Created 7 days ago on 2025-06-17

About

The kubeconfig file is a critical component in Kubernetes environments, containing configuration details for accessing and managing Kubernetes clusters. Attackers may attempt to get access to, create or modify kubeconfig files to gain unauthorized initial access to Kubernetes clusters or move laterally within the cluster.
Tags
Domain: EndpointDomain: ContainerOS: LinuxUse Case: Threat DetectionTactic: Lateral MovementTactic: Defense EvasionTactic: Initial AccessData Source: Elastic DefendLanguage: eql
Severity
medium
Risk Score
47
MITRE ATT&CK™

Lateral Movement (TA0008)(opens in a new tab or window)

↳ Use Alternate Authentication Material (T1550)(opens in a new tab or window)

Defense Evasion (TA0005)(opens in a new tab or window)

↳ Use Alternate Authentication Material (T1550)(opens in a new tab or window)

Initial Access (TA0001)(opens in a new tab or window)

↳ Valid Accounts (T1078)(opens in a new tab or window)

License
Elastic License v2(opens in a new tab or window)

Definition

Rule Type
Event Correlation Rule
Integration Pack
Prebuilt Security Detection Rules
Index Patterns
logs-endpoint.events.file*
Related Integrations

endpoint(opens in a new tab or window)

Query
file where host.os.type == "linux" and event.type != "deletion" and file.path like (
  "/root/.kube/config",
  "/home/*/.kube/config",
  "/etc/kubernetes/admin.conf",
  "/etc/kubernetes/super-admin.conf",
  "/etc/kubernetes/kubelet.conf",
  "/etc/kubernetes/controller-manager.conf",
  "/etc/kubernetes/scheduler.conf",
  "/var/lib/*/kubeconfig"
) and not (
  process.name in ("kubeadm", "kubelet", "vcluster", "minikube") or
  (process.name == "sed" and file.Ext.original.name like "sed*")
)

Install detection rules in Elastic Security

Detect Kubeconfig File Creation or Modification in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(opens in a new tab or window).