Kubernetes RBAC RoleBinding Created or Modified via Audit Events

title: Kubernetes RBAC RoleBinding Created or Modified via Audit Events
id: 14587918-9646-4182-8c8f-5be5316869d4
related:
  - id: 0322d9f2-289a-47c2-b5e1-b63c90901a3e
    type: similar
  - id: 10b97915-ec8d-455f-a815-9a78926585f6
    type: derived
status: test
description: This rule flags Kubernetes audit events where a RoleBinding or ClusterRoleBinding is created or modified. Attackers may change RBAC bindings to grant additional permissions or persistence within a cluster. The detection relies on Kubernetes audit telemetry that includes the RBAC API group, the bound resource type, and the HTTP verb indicating the operation.
references:
  - https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/
  - https://medium.com/@seifeddinerajhi/kubernetes-rbac-privilege-escalation-exploits-and-mitigations-26c07629eeab
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/kubernetes/audit/kubernetes_audit_rolebinding_modification.yml
author: kelnage, Huntrule Team
date: 2024-07-11
tags:
  - attack.privilege-escalation
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    objectRef.apiGroup: rbac.authorization.k8s.io
    objectRef.resource:
      - clusterrolebindings
      - rolebindings
    verb:
      - create
      - delete
      - patch
      - replace
      - update
  condition: selection
falsepositives:
  - Modifying a Kubernetes Rolebinding may need to be done by a system administrator.
  - Automated processes may need to take these actions and may need to be filtered.
level: medium
license: DRL-1.1