huntrule

Azure Kubernetes RBAC RoleBinding/ClusterRoleBinding Written or Deleted

Alerts on Azure Kubernetes RBAC RoleBinding/ClusterRoleBinding write or delete events that may indicate permission changes.

FreeReviewedSigma · Medium · v5
Product
azure
Service
activitylogs
Author
Austin Songer @austinsonger (SigmaHQ), DRL 1.1
Published
2021-08-07
Updated
2026-07-31
AnalysisDetection
title: Azure Kubernetes RBAC RoleBinding/ClusterRoleBinding Written or Deleted
id: 3a4bd822-c7ed-48f9-9ccd-97f4b034b088
status: test
description: This rule identifies Azure Activity Log events where Kubernetes RBAC RoleBinding or ClusterRoleBinding objects are written (created/modified) or deleted. Attackers may change these bindings to grant or remove cluster permissions, enabling privilege escalation or unauthorized access. The detection relies on Activity Log operationName telemetry for RoleBinding/ClusterRoleBinding write and delete operations and can be investigated by the requesting identity.
references:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes
  - https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/
  - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/
  - https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/activity_logs/azure_kubernetes_rolebinding_modified_or_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-07
modified: 2022-08-23
tags:
  - attack.impact
  - attack.credential-access
  - attack.t1485
  - attack.t1496
  - attack.t1489
logsource:
  product: azure
  service: activitylogs
detection:
  selection:
    operationName:
      - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/CLUSTERROLEBINDINGS/WRITE
      - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/CLUSTERROLEBINDINGS/DELETE
      - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/ROLEBINDINGS/WRITE
      - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/ROLEBINDINGS/DELETE
  condition: selection
falsepositives:
  - RoleBinding/ClusterRoleBinding being modified and deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - RoleBinding/ClusterRoleBinding modification from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: 25cb259b-bbdc-4b87-98b7-90d7c72f8743
    type: derived