GCP Audit Logs: Kubernetes RoleBinding and ClusterRoleBinding create/patch/update/delete

Flags GCP audit events where Kubernetes RBAC RoleBindings/ClusterRoleBindings are created, modified, or removed.

FreeUnreviewedSigmamediumv1

gcp-audit-logs-kubernetes-rolebinding-and-clusterrolebinding-create-patch-update-0322d9f2

title: "GCP Audit Logs: Kubernetes RoleBinding and ClusterRoleBinding create/patch/update/delete"
id: 1e313674-e886-45d9-b0f7-98a69d2bcfc8
status: test
description: This rule identifies Kubernetes RBAC RoleBinding and ClusterRoleBinding changes in Google Cloud by matching GCP audit log method names for create, patch, update, and delete. Malicious actors can use these operations to grant themselves or others unauthorized permissions within a cluster. It relies on GCP audit telemetry that records Kubernetes authorization RBAC method calls (io.k8s.authorization.rbac.v*).
references:
  - https://github.com/elastic/detection-rules/pull/1267
  - https://kubernetes.io/docs/reference/kubernetes-api/authorization-resources/cluster-role-v1/#ClusterRole
  - https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control
  - https://kubernetes.io/docs/reference/access-authn-authz/rbac/
  - https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/audit/gcp_kubernetes_rolebinding.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-09
modified: 2022-10-09
tags:
  - attack.credential-access
logsource:
  product: gcp
  service: gcp.audit
detection:
  selection:
    gcp.audit.method_name:
      - io.k8s.authorization.rbac.v*.clusterrolebindings.create
      - io.k8s.authorization.rbac.v*.rolebindings.create
      - io.k8s.authorization.rbac.v*.clusterrolebindings.patch
      - io.k8s.authorization.rbac.v*.rolebindings.patch
      - io.k8s.authorization.rbac.v*.clusterrolebindings.update
      - io.k8s.authorization.rbac.v*.rolebindings.update
      - io.k8s.authorization.rbac.v*.clusterrolebindings.delete
      - io.k8s.authorization.rbac.v*.rolebindings.delete
  condition: selection
falsepositives:
  - RoleBindings and ClusterRoleBinding being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - RoleBindings and ClusterRoleBinding modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: 0322d9f2-289a-47c2-b5e1-b63c90901a3e
    type: derived

What it detects

This rule identifies Kubernetes RBAC RoleBinding and ClusterRoleBinding changes in Google Cloud by matching GCP audit log method names for create, patch, update, and delete. Malicious actors can use these operations to grant themselves or others unauthorized permissions within a cluster. It relies on GCP audit telemetry that records Kubernetes authorization RBAC method calls (io.k8s.authorization.rbac.v*).

Known false positives

RoleBindings and ClusterRoleBinding being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
RoleBindings and ClusterRoleBinding modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.