Detectionmediumtest

Google Cloud Kubernetes RoleBinding

Detects the creation or patching of potential malicious RoleBinding. This includes RoleBindings and ClusterRoleBinding.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Austin SongerCreated Mon Aug 09Updated Sun Oct 090322d9f2-289a-47c2-b5e1-b63c90901a3ecloud

Log Source

Google Cloudgcp.audit

ProductGoogle Cloud← raw: gcp

Servicegcp.audit← raw: gcp.audit

Detection Logic

detection:
    selection:
        gcp.audit.method_name:
            - io.k8s.authorization.rbac.v*.clusterrolebindings.create
            - io.k8s.authorization.rbac.v*.rolebindings.create
            - io.k8s.authorization.rbac.v*.clusterrolebindings.patch
            - io.k8s.authorization.rbac.v*.rolebindings.patch
            - io.k8s.authorization.rbac.v*.clusterrolebindings.update
            - io.k8s.authorization.rbac.v*.rolebindings.update
            - io.k8s.authorization.rbac.v*.clusterrolebindings.delete
            - io.k8s.authorization.rbac.v*.rolebindings.delete
    condition: selection

False Positives

RoleBindings and ClusterRoleBinding being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.

RoleBindings and ClusterRoleBinding modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.

References

MITRE ATT&CK