Credential Access: Failed Attempt to Approve Kubernetes Certificate Signing Request (CSR)

This document describes a threat finding type in Security Command Center. Threat findings are generated by threat detectors when they detect a potential threat in your cloud resources. For a full list of available threat findings, see Threat findings index.

Overview

Someone attempted to manually approve a certificate signing request (CSR) but the action failed. Creating a certificate for cluster authentication is a common method for attackers to create persistent access to a compromised cluster. The permissions associated with the certificate vary depending on which subject they included, but can be highly privileged. For more details, see the log message for this alert.

How to respond

The following response plan might be appropriate for this finding, but might also impact operations. Carefully evaluate the information you gather in your investigation to determine the best way to resolve findings.

To respond to this finding, do the following:

  1. Review the audit logs in Cloud Logging and additional alerts for other CSR related events to determine if any CSR was approved and issued and if CSR related actions are expected activity by the principal.
  2. Determine whether there are other signs of malicious activity by the principal in the audit logs in Cloud Logging. For example:
    • Was the principal who attempted to approve the CSR different from the one who created it?
    • Has the principal tried requesting, creating, approving, or deleting other CSRs?
  3. If a CSR approval was not expected, or is determined to be malicious, the cluster will require a credential rotation to invalidate the certificate. Review the guidance for performing a rotation of your cluster credentials.

What's next