Kubernetes Service Account Token Theft

Lacey Cochrane@NullVectorX

•updated May 4, 2026•5•0•314

Detects non-legitimate processes attempting to read Kubernetes service account tokens or related sensitive files (ca.crt, namespace) from the standard service account path within containers. This rule filters out common and legitimate Kubernetes system processes to reduce false positives.