GCP Kubernetes RBAC RoleBinding Create/Patch/Update/Delete Audit Events
Flags GCP audit events where Kubernetes RBAC RoleBindings/ClusterRoleBindings are created, modified, or removed.
FreeReviewedSigma · Medium · v4
- Product
- gcp
- Service
- gcp.audit
- Author
- Austin Songer @austinsonger (SigmaHQ), DRL 1.1
- Published
- 2021-08-09
- Updated
- 2026-07-31
What it detects
This rule identifies Kubernetes RBAC RoleBinding and ClusterRoleBinding changes in Google Cloud audit logs, including create, patch, update, and delete operations. Attackers may abuse RBAC modifications to grant unauthorized permissions and escalate access within a cluster. The detection relies on GCP audit telemetry that records Kubernetes authorization RPC method names for RBAC binding resource actions.
Reporting behind it
- github.comhttps://github.com/elastic/detection-rules/pull/1267
- kubernetes.iohttps://kubernetes.io/docs/reference/kubernetes-api/authorization-resources/cluster-role-v1/#ClusterRole
- cloud.google.comhttps://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control
- kubernetes.iohttps://kubernetes.io/docs/reference/access-authn-authz/rbac/
- cloud.google.comhttps://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/audit/gcp_kubernetes_rolebinding.yml
Changelog
v4- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
gcp-audit-logs-kubernetes-rolebinding-and-clusterrolebinding-create-patch-update-0322d9f2
title: GCP Kubernetes RBAC RoleBinding Create/Patch/Update/Delete Audit Events
id: 1e313674-e886-45d9-b0f7-98a69d2bcfc8
status: test
description: This rule identifies Kubernetes RBAC RoleBinding and ClusterRoleBinding changes in Google Cloud audit logs, including create, patch, update, and delete operations. Attackers may abuse RBAC modifications to grant unauthorized permissions and escalate access within a cluster. The detection relies on GCP audit telemetry that records Kubernetes authorization RPC method names for RBAC binding resource actions.
references:
- https://github.com/elastic/detection-rules/pull/1267
- https://kubernetes.io/docs/reference/kubernetes-api/authorization-resources/cluster-role-v1/#ClusterRole
- https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control
- https://kubernetes.io/docs/reference/access-authn-authz/rbac/
- https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/audit/gcp_kubernetes_rolebinding.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-09
modified: 2022-10-09
tags:
- attack.credential-access
logsource:
product: gcp
service: gcp.audit
detection:
selection:
gcp.audit.method_name:
- io.k8s.authorization.rbac.v*.clusterrolebindings.create
- io.k8s.authorization.rbac.v*.rolebindings.create
- io.k8s.authorization.rbac.v*.clusterrolebindings.patch
- io.k8s.authorization.rbac.v*.rolebindings.patch
- io.k8s.authorization.rbac.v*.clusterrolebindings.update
- io.k8s.authorization.rbac.v*.rolebindings.update
- io.k8s.authorization.rbac.v*.clusterrolebindings.delete
- io.k8s.authorization.rbac.v*.rolebindings.delete
condition: selection
falsepositives:
- RoleBindings and ClusterRoleBinding being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
- RoleBindings and ClusterRoleBinding modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
- id: 0322d9f2-289a-47c2-b5e1-b63c90901a3e
type: derived