GKE Service Account Modified RBAC Objects

  1[metadata]
  2creation_date = "2026/07/10"
  3integration = ["gcp"]
  4maturity = "production"
  5updated_date = "2026/07/10"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects write operations performed by GKE service accounts against RBAC resources (Roles, ClusterRoles, RoleBindings,
 11ClusterRoleBindings). Service accounts typically do not manage RBAC directly; this activity may indicate token abuse or
 12unauthorized privilege escalation.
 13"""
 14false_positives = [
 15    """
 16    In-cluster controllers, operators, and CI jobs may legitimately reconcile RBAC manifests. Baseline known automation
 17    service accounts before tuning.
 18    """,
 19]
 20from = "now-6m"
 21index = ["logs-gcp.audit-*"]
 22language = "kuery"
 23license = "Elastic License v2"
 24name = "GKE Service Account Modified RBAC Objects"
 25note = """## Triage and analysis
 26
 27### Investigating GKE Service Account Modified RBAC Objects
 28
 29This rule detects service accounts performing allowed write actions on RBAC resources. Stolen or over-privileged service
 30account tokens can silently alter authorization to gain or retain elevated access.
 31
 32### Possible investigation steps
 33
 34- Review `client.user.email`, `event.action`, and `gcp.audit.resource_name`.
 35- Trace the acting service account to its owning workload and inspect recent image changes or exec activity.
 36- Correlate with change tickets or GitOps commits for the same RBAC object.
 37
 38### False positive analysis
 39
 40- Platform operators and GitOps controllers running in-cluster commonly create or patch RBAC objects.
 41
 42### Response and remediation
 43
 44- Revert unauthorized RBAC changes, rotate the service account credentials, and tighten RBAC for the workload.
 45
 46"""
 47setup = "The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule."
 48references = [
 49    "https://kubernetes.io/docs/reference/access-authn-authz/rbac/",
 50    "https://heilancoos.github.io/research/2025/12/16/kubernetes.html#overly-permissive-role-based-access-control",
 51]
 52risk_score = 47
 53rule_id = "c41e9854-3df3-465a-8234-4d625084ff86"
 54severity = "medium"
 55tags = [
 56    "Domain: Cloud",
 57    "Domain: Kubernetes",
 58    "Data Source: GCP",
 59    "Data Source: Google Cloud Platform",
 60    "Use Case: Threat Detection",
 61    "Tactic: Privilege Escalation",
 62    "Tactic: Persistence",
 63    "Resources: Investigation Guide",
 64]
 65timestamp_override = "event.ingested"
 66type = "query"
 67
 68query = '''
 69data_stream.dataset:gcp.audit and service.name:"k8s.io" and event.outcome:success and
 70client.user.email:(system\:serviceaccount\:* and not (
 71  "system:serviceaccount:kube-system:clusterrole-aggregation-controller" or
 72  "system:serviceaccount:kube-system:generic-garbage-collector"
 73)) and event.action:(
 74  "io.k8s.authorization.rbac.v1.clusterrolebindings.create" or
 75  "io.k8s.authorization.rbac.v1.clusterrolebindings.delete" or
 76  "io.k8s.authorization.rbac.v1.clusterrolebindings.patch" or
 77  "io.k8s.authorization.rbac.v1.clusterrolebindings.update" or
 78  "io.k8s.authorization.rbac.v1.clusterroles.create" or
 79  "io.k8s.authorization.rbac.v1.clusterroles.delete" or
 80  "io.k8s.authorization.rbac.v1.clusterroles.patch" or
 81  "io.k8s.authorization.rbac.v1.clusterroles.update" or
 82  "io.k8s.authorization.rbac.v1.rolebindings.create" or
 83  "io.k8s.authorization.rbac.v1.rolebindings.delete" or
 84  "io.k8s.authorization.rbac.v1.rolebindings.patch" or
 85  "io.k8s.authorization.rbac.v1.rolebindings.update" or
 86  "io.k8s.authorization.rbac.v1.roles.create" or
 87  "io.k8s.authorization.rbac.v1.roles.delete" or
 88  "io.k8s.authorization.rbac.v1.roles.patch" or
 89  "io.k8s.authorization.rbac.v1.roles.update"
 90)
 91'''
 92
 93[[rule.threat]]
 94framework = "MITRE ATT&CK"
 95
 96[[rule.threat.technique]]
 97id = "T1098"
 98name = "Account Manipulation"
 99reference = "https://attack.mitre.org/techniques/T1098/"
100
101[[rule.threat.technique.subtechnique]]
102id = "T1098.006"
103name = "Additional Container Cluster Roles"
104reference = "https://attack.mitre.org/techniques/T1098/006/"
105
106[rule.threat.tactic]
107id = "TA0004"
108name = "Privilege Escalation"
109reference = "https://attack.mitre.org/tactics/TA0004/"
110
111[[rule.threat]]
112framework = "MITRE ATT&CK"
113
114[[rule.threat.technique]]
115id = "T1098"
116name = "Account Manipulation"
117reference = "https://attack.mitre.org/techniques/T1098/"
118
119[[rule.threat.technique.subtechnique]]
120id = "T1098.006"
121name = "Additional Container Cluster Roles"
122reference = "https://attack.mitre.org/techniques/T1098/006/"
123
124[rule.threat.tactic]
125id = "TA0003"
126name = "Persistence"
127reference = "https://attack.mitre.org/tactics/TA0003/"
128
129[rule.investigation_fields]
130field_names = [
131    "@timestamp",
132    "client.user.email",
133    "source.ip",
134    "user_agent.original",
135    "event.action",
136    "event.outcome",
137    "gcp.audit.resource_name",
138    "gcp.audit.request.kind",
139    "data_stream.namespace",
140]