Kubernetes RBAC Permission Enumeration Attempt
Detects attempts by an identity to enumerate its Kubernetes Role-Based Access Control (RBAC) permissions. This activity is often observed in the early stages of a breach as attackers try to understand their access within a compromised Kubernetes environment. This can be achieved by querying the Kubernetes API server's SelfSubjectRulesReview API, for example, using the "kubectl auth can-i --list" command.
Sigma
