Kubectl privilege escalation alerts are your only line of sight into this kind of move. In Kubernetes, RBAC is the gatekeeper. But misconfigured roles, wildcards in permissions, or compromised service accounts can let an attacker escape the namespace and take control. Once they have elevated kubectl access, they can read secrets, delete workloads, or deploy malicious containers.
Detection depends on visibility. The Kubernetes audit log records every API call. Parsing it for privilege escalation patterns—such as create clusterrole with * rules or bind actions to high-privilege roles—is essential. Look for anomalies in kubectl exec, suspicious impersonate requests, or sudden changes to ClusterRoleBinding. These are high-value signals that should trigger immediate alerts.
Centralized logging platforms tied to real-time alerting make this practical. Feed audit logs into your SIEM or an open-source rules engine. Define clear thresholds for escalation events. Combine with admission controllers to block dangerous changes before they apply. Monitor service accounts in system namespaces, since attackers often target them for privilege jumps.