GKE Cluster-Admin Role Binding Created or Modified

  1[metadata]
  2creation_date = "2026/06/30"
  3integration = ["gcp"]
  4maturity = "production"
  5updated_date = "2026/07/10"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects creation or modification of a GKE ClusterRoleBinding that grants the cluster-admin ClusterRole, providing
 11unrestricted cluster access and enabling rapid privilege escalation or persistence.
 12"""
 13index = ["logs-gcp.audit-*"]
 14language = "kuery"
 15license = "Elastic License v2"
 16name = "GKE Cluster-Admin Role Binding Created or Modified"
 17note = """## Triage and analysis
 18
 19### Investigating GKE Cluster-Admin Role Binding Created or Modified
 20
 21Identify who created or changed the binding and which subject received cluster-admin.
 22
 23### Investigation steps
 24
 25- Review `client.user.email`, `source.ip`, and `gcp.audit.request` for the bound subject.
 26- Hunt for secret reads, privileged pod creation, or webhook changes from the same actor or new subject.
 27
 28### False positives
 29
 30- Bootstrap and recovery may recreate cluster-admin bindings via `system:apiserver` during control plane reconciliation (excluded).
 31
 32"""
 33setup = "The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule."
 34references = [
 35    "https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control",
 36    "https://heilancoos.github.io/research/2025/12/16/kubernetes.html#overly-permissive-role-based-access-control",
 37]
 38risk_score = 47
 39rule_id = "16708afb-4904-4d3c-af78-63640a075cb0"
 40severity = "medium"
 41tags = [
 42    "Domain: Cloud",
 43    "Domain: Kubernetes",
 44    "Data Source: GCP",
 45    "Data Source: Google Cloud Platform",
 46    "Use Case: Threat Detection",
 47    "Tactic: Persistence",
 48    "Tactic: Privilege Escalation",
 49    "Resources: Investigation Guide",
 50]
 51timestamp_override = "event.ingested"
 52type = "query"
 53
 54query = '''
 55data_stream.dataset:gcp.audit and service.name:"k8s.io" and event.outcome:success and
 56event.action:(
 57  "io.k8s.authorization.rbac.v1.clusterrolebindings.create" or
 58  "io.k8s.authorization.rbac.v1.clusterrolebindings.patch" or
 59  "io.k8s.authorization.rbac.v1.clusterrolebindings.update"
 60) and gcp.audit.request.kind:"ClusterRoleBinding" and
 61gcp.audit.resource_name:"rbac.authorization.k8s.io/v1/clusterrolebindings/cluster-admin" and
 62not client.user.email:"system:apiserver"
 63'''
 64
 65[[rule.threat]]
 66framework = "MITRE ATT&CK"
 67
 68[[rule.threat.technique]]
 69id = "T1098"
 70name = "Account Manipulation"
 71reference = "https://attack.mitre.org/techniques/T1098/"
 72
 73[[rule.threat.technique.subtechnique]]
 74id = "T1098.006"
 75name = "Additional Container Cluster Roles"
 76reference = "https://attack.mitre.org/techniques/T1098/006/"
 77
 78[rule.threat.tactic]
 79id = "TA0003"
 80name = "Persistence"
 81reference = "https://attack.mitre.org/tactics/TA0003/"
 82
 83[[rule.threat]]
 84framework = "MITRE ATT&CK"
 85
 86[[rule.threat.technique]]
 87id = "T1098"
 88name = "Account Manipulation"
 89reference = "https://attack.mitre.org/techniques/T1098/"
 90
 91[[rule.threat.technique.subtechnique]]
 92id = "T1098.006"
 93name = "Additional Container Cluster Roles"
 94reference = "https://attack.mitre.org/techniques/T1098/006/"
 95
 96[rule.threat.tactic]
 97id = "TA0004"
 98name = "Privilege Escalation"
 99reference = "https://attack.mitre.org/tactics/TA0004/"
100
101[rule.investigation_fields]
102field_names = [
103    "@timestamp",
104    "client.user.email",
105    "source.ip",
106    "user_agent.original",
107    "event.action",
108    "event.outcome",
109    "gcp.audit.resource_name",
110    "gcp.audit.request.kind",
111    "gcp.audit.request.roleRef.name",
112    "gcp.audit.request.subjects.name",
113    "data_stream.namespace",
114]