Suspicious Kubernetes Rolebinding Change (via audit)

title: Suspicious Kubernetes Rolebinding Change (via audit)
id: 3703a2e8-cf83-5b1d-b169-393a2290b1d0
status: stable
description: This rule detects when a Kubernetes Rolebinding is created or modified.
references:
    - https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/
    - https://medium.com/@seifeddinerajhi/kubernetes-rbac-privilege-escalation-exploits-and-mitigations-26c07629eeab
author: Huntrule Team
date: 2026-07-06
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1098
logsource:
    product: kubernetes
    service: audit
detection:
    selection:
        objectRef.apiGroup: 'rbac.authorization.k8s.io'
        objectRef.resource:
            - 'clusterrolebindings'
            - 'rolebindings'
        verb:
            - 'create'
            - 'delete'
            - 'patch'
            - 'replace'
            - 'update'
    condition: selection
falsepositives:
    - Unknown
level: medium