Kubernetes RBAC RoleBinding Created or Modified via Audit Events
Alerts on Kubernetes RBAC RoleBinding/ClusterRoleBinding create or update actions seen in audit logs.
FreeReviewedSigma · Medium · v5
- Product
- kubernetes
- Service
- audit
- Author
- kelnage (SigmaHQ), DRL 1.1
- Published
- 2024-07-11
- Updated
- 2026-07-31
What it detects
This rule flags Kubernetes audit events where a RoleBinding or ClusterRoleBinding is created or modified. Attackers may change RBAC bindings to grant additional permissions or persistence within a cluster. The detection relies on Kubernetes audit telemetry that includes the RBAC API group, the bound resource type, and the HTTP verb indicating the operation.
Reporting behind it
- kubernetes.iohttps://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/
- medium.comhttps://medium.com/@seifeddinerajhi/kubernetes-rbac-privilege-escalation-exploits-and-mitigations-26c07629eeab
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/application/kubernetes/audit/kubernetes_audit_rolebinding_modification.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
kubernetes-audit-rolebinding-clusterrolebinding-created-or-modified-via-rbac-api-10b97915
title: Kubernetes RBAC RoleBinding Created or Modified via Audit Events
id: 14587918-9646-4182-8c8f-5be5316869d4
related:
- id: 0322d9f2-289a-47c2-b5e1-b63c90901a3e
type: similar
- id: 10b97915-ec8d-455f-a815-9a78926585f6
type: derived
status: test
description: This rule flags Kubernetes audit events where a RoleBinding or ClusterRoleBinding is created or modified. Attackers may change RBAC bindings to grant additional permissions or persistence within a cluster. The detection relies on Kubernetes audit telemetry that includes the RBAC API group, the bound resource type, and the HTTP verb indicating the operation.
references:
- https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/
- https://medium.com/@seifeddinerajhi/kubernetes-rbac-privilege-escalation-exploits-and-mitigations-26c07629eeab
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/kubernetes/audit/kubernetes_audit_rolebinding_modification.yml
author: kelnage, Huntrule Team
date: 2024-07-11
tags:
- attack.privilege-escalation
logsource:
product: kubernetes
service: audit
detection:
selection:
objectRef.apiGroup: rbac.authorization.k8s.io
objectRef.resource:
- clusterrolebindings
- rolebindings
verb:
- create
- delete
- patch
- replace
- update
condition: selection
falsepositives:
- Modifying a Kubernetes Rolebinding may need to be done by a system administrator.
- Automated processes may need to take these actions and may need to be filtered.
level: medium
license: DRL-1.1