Credential Access: Manually Approved Kubernetes Certificate Signing Request (CSR)

This document describes a threat finding type in Security Command Center. Threat findings are generated by threat detectors when they detect a potential threat in your cloud resources. For a full list of available threat findings, see Threat findings index.

Overview

Someone manually approved a certificate signing request (CSR). Creating a certificate for cluster authentication is a common method for attackers to create persistent access to a compromised cluster. The permissions associated with the certificate vary depending on which subject they included, but can be highly privileged. For more details, see the log message for this alert.

How to respond

The following response plan might be appropriate for this finding, but might also impact operations. Carefully evaluate the information you gather in your investigation to determine the best way to resolve findings.

To respond to this finding, do the following:

  1. Review the audit logs in Cloud Logging and additional alerts for other CSR related events to determine if CSR related actions are expected activity by the principal.
  2. Determine whether there are other signs of malicious activity by the principal in the audit logs in Cloud Logging. For example:
    • Was the principal who approved the CSR different from the one who created it?
    • Did the CSR specify a built-in signer, but ultimately need to be manually approved because it did not meet the signer's criteria?
    • Has the principal tried requesting, creating, approving, or deleting other CSRs?
  3. If a CSR approval was not expected, or is determined to be malicious, the cluster will require a credential rotation to invalidate the certificate. Review the guidance for performing a rotation of your cluster credentials.

What's next