Azure Activity Logs: Kubernetes RBAC Roles/ClusterRoles Modified or Deleted

Alerts on Azure Kubernetes RBAC Role/ClusterRole writes, deletions, bind, or escalation actions in activity logs.

FreeUnreviewedSigmamediumv1

azure-activity-logs-kubernetes-rbac-roles-clusterroles-modified-or-deleted-818fee0c

title: "Azure Activity Logs: Kubernetes RBAC Roles/ClusterRoles Modified or Deleted"
id: 4869aa2c-48fd-4968-9b21-4ca3e86ccee1
status: test
description: This rule flags Azure Kubernetes RBAC authorization changes where ClusterRoles or Roles are written, deleted, or granted high-impact actions such as bind or escalate. Attackers can abuse RBAC modifications to gain or expand permissions within a connected cluster. The detection relies on Azure Activity Log events with specific operation names covering ROLES/CLUSTERROLES write, delete, bind, and escalate action changes.
references:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes
  - https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/
  - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/
  - https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/activity_logs/azure_kubernetes_role_access.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-07
modified: 2022-08-23
tags:
  - attack.impact
  - attack.t1485
  - attack.t1496
  - attack.t1489
logsource:
  product: azure
  service: activitylogs
detection:
  selection:
    operationName:
      - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/ROLES/WRITE
      - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/ROLES/DELETE
      - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/ROLES/BIND/ACTION
      - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/ROLES/ESCALATE/ACTION
      - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/CLUSTERROLES/WRITE
      - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/CLUSTERROLES/DELETE
      - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/CLUSTERROLES/BIND/ACTION
      - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/CLUSTERROLES/ESCALATE/ACTION
  condition: selection
falsepositives:
  - ClusterRoles/Roles being modified and deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - ClusterRoles/Roles modification from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: 818fee0c-e0ec-4e45-824e-83e4817b0887
    type: derived

What it detects

This rule flags Azure Kubernetes RBAC authorization changes where ClusterRoles or Roles are written, deleted, or granted high-impact actions such as bind or escalate. Attackers can abuse RBAC modifications to gain or expand permissions within a connected cluster. The detection relies on Azure Activity Log events with specific operation names covering ROLES/CLUSTERROLES write, delete, bind, and escalate action changes.

Known false positives

ClusterRoles/Roles being modified and deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
ClusterRoles/Roles modification from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.