Google Cloud Kubernetes RoleBinding

calendar Oct 12, 2023 · attack.credential_access  ·
Share on: linkedin copy

Detects the creation or patching of potential malicious RoleBinding. This includes RoleBindings and ClusterRoleBinding.

Sigma rule (View on GitHub)

 1title: Google Cloud Kubernetes RoleBinding
 2id: 0322d9f2-289a-47c2-b5e1-b63c90901a3e
 3status: test
 4description: Detects the creation or patching of potential malicious RoleBinding. This includes RoleBindings and ClusterRoleBinding.
 5references:
 6    - https://github.com/elastic/detection-rules/pull/1267
 7    - https://kubernetes.io/docs/reference/kubernetes-api/authorization-resources/cluster-role-v1/#ClusterRole
 8    - https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control
 9    - https://kubernetes.io/docs/reference/access-authn-authz/rbac/
10    - https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging
11author: Austin Songer @austinsonger
12date: 2021/08/09
13modified: 2022/10/09
14tags:
15    - attack.credential_access
16logsource:
17    product: gcp
18    service: gcp.audit
19detection:
20    selection:
21        gcp.audit.method_name:
22            - io.k8s.authorization.rbac.v*.clusterrolebindings.create
23            - io.k8s.authorization.rbac.v*.rolebindings.create
24            - io.k8s.authorization.rbac.v*.clusterrolebindings.patch
25            - io.k8s.authorization.rbac.v*.rolebindings.patch
26            - io.k8s.authorization.rbac.v*.clusterrolebindings.update
27            - io.k8s.authorization.rbac.v*.rolebindings.update
28            - io.k8s.authorization.rbac.v*.clusterrolebindings.delete
29            - io.k8s.authorization.rbac.v*.rolebindings.delete
30    condition: selection
31falsepositives:
32    - RoleBindings and ClusterRoleBinding being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
33    - RoleBindings and ClusterRoleBinding modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
34level: medium

References

Related rules

to-top