---
title: GKE Suspicious Self-Subject Review via Service Account
description: Detects GKE service account or node identities invoking self-subject access or rules review APIs. Non-human identities rarely enumerate their own permissions...
url: https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/gcp/discovery_gcp_gke_suspicious_self_subject_review
products:
  - Elastic Security
---

# GKE Suspicious Self-Subject Review via Service Account
Detects GKE service account or node identities invoking self-subject access or rules review APIs. Non-human identities
rarely enumerate their own permissions outside known controllers; this can indicate stolen tokens probing effective RBAC.
**Rule type**: query
**Rule indices**:
- logs-gcp.audit-*

**Rule Severity**: low
**Risk Score**: 21
**Runs every**: 
**Searches indices from**: ``
**Maximum alerts per execution**: 100
**References**:
- [[https://kubernetes.io/docs/reference/access-authn-authz/authorization/#checking-api-access](https://kubernetes.io/docs/reference/access-authn-authz/authorization/#checking-api-access)](https://kubernetes.io/docs/reference/access-authn-authz/authorization/#checking-api-access)

**Tags**:
- Domain: Cloud
- Domain: Kubernetes
- Data Source: GCP
- Data Source: Google Cloud Platform
- Use Case: Threat Detection
- Tactic: Discovery
- Resources: Investigation Guide
- Noise: Unknown
- Performance: Fast
- Rule Type: Custom Query (KQL)
- Platform: GCP
- Domain: Containers
- Platform: Kubernetes

**Version**: 2
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2

## Investigation guide


## Triage and analysis


### Investigating GKE Suspicious Self-Subject Review via Service Account

Review the calling service account or node identity and subsequent API activity.

### Investigation steps

- Confirm `user.email` and `event.action` (selfsubjectaccessreviews or selfsubjectrulesreviews).
- Correlate with denied requests, secret access, or RBAC changes from the same identity.


### False positives

- Known observability or workflow controllers; extend exclusions if needed.


## Setup

The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule.

## Rule Query

```kuery
data_stream.dataset:gcp.audit and service.name:k8s.io and event.action:(io.k8s.authorization.v1.selfsubjectaccessreviews.create or io.k8s.authorization.v1.selfsubjectrulesreviews.create) and user.email:((system\:node\:* or system\:serviceaccount\:*) and not ("system:serviceaccount:default:argo-argo-workflows-server" or "system:serviceaccount:default:argo-argo-workflows-workflow-controller" or system\:serviceaccount\:*\:datadog-kube-state-metrics))
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Discovery
  - Id: TA0007
  - Reference URL: [[https://attack.mitre.org/tactics/TA0007/](https://attack.mitre.org/tactics/TA0007/)](https://attack.mitre.org/tactics/TA0007/)
- Technique:
  - Name: Permission Groups Discovery
  - Id: T1069
  - Reference URL: [[https://attack.mitre.org/techniques/T1069/](https://attack.mitre.org/techniques/T1069/)](https://attack.mitre.org/techniques/T1069/)
- Sub Technique:
  - Name: Cloud Groups
  - Id: T1069.003
  - Reference URL: [[https://attack.mitre.org/techniques/T1069/003/](https://attack.mitre.org/techniques/T1069/003/)](https://attack.mitre.org/techniques/T1069/003/)
- Technique:
  - Name: Container and Resource Discovery
  - Id: T1613
  - Reference URL: [[https://attack.mitre.org/techniques/T1613/](https://attack.mitre.org/techniques/T1613/)](https://attack.mitre.org/techniques/T1613/)