Detection rules › By event

Kubernetes-clusterrolebindings

Event	Rules
get-clusterrolebindings	2
list-clusterrolebindings	2
watch-clusterrolebindings	1
create-clusterrolebindings	12
update-clusterrolebindings	6
patch-clusterrolebindings	6
delete-clusterrolebindings	5
any-clusterrolebindings	1

get-clusterrolebindings

2 detection rules reference this event. View event page.

Elastic (2)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
GKE Multi-Resource Discovery severity medium T1613

list-clusterrolebindings

2 detection rules reference this event. View event page.

Elastic (2)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
GKE Multi-Resource Discovery severity medium T1613

watch-clusterrolebindings

1 detection rules reference this event. View event page.

Elastic (1)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610

create-clusterrolebindings

12 detection rules reference this event. View event page.

Sigma (2)

Google Cloud Kubernetes RoleBinding severity medium
Kubernetes Rolebinding Modification severity medium

Elastic (7)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
GKE Cluster-Admin Role Binding Created or Modified severity medium T1098, T1098.006
GKE Creation of a RoleBinding Referencing a ServiceAccount severity medium T1098, T1098.006
GKE Service Account Modified RBAC Objects severity medium T1098, T1098.006
Kubernetes Cluster-Admin Role Binding Created severity medium T1098, T1098.006
Kubernetes Creation of a RoleBinding Referencing a ServiceAccount severity medium T1098, T1098.006
Kubernetes Service Account Modified RBAC Objects severity medium T1098, T1098.006

Panther (1)

Kubernetes ClusterRoleBinding to Privileged Role severity medium T1078.004, T1098

Falco (2)

Attach to cluster-admin Role severity WARNING
K8s ClusterRoleBinding Created severity INFO

update-clusterrolebindings

6 detection rules reference this event. View event page.

Sigma (2)

Google Cloud Kubernetes RoleBinding severity medium
Kubernetes Rolebinding Modification severity medium

Elastic (4)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
GKE Cluster-Admin Role Binding Created or Modified severity medium T1098, T1098.006
GKE Service Account Modified RBAC Objects severity medium T1098, T1098.006
Kubernetes Service Account Modified RBAC Objects severity medium T1098, T1098.006

patch-clusterrolebindings

6 detection rules reference this event. View event page.

Sigma (2)

Google Cloud Kubernetes RoleBinding severity medium
Kubernetes Rolebinding Modification severity medium

Elastic (4)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
GKE Cluster-Admin Role Binding Created or Modified severity medium T1098, T1098.006
GKE Service Account Modified RBAC Objects severity medium T1098, T1098.006
Kubernetes Service Account Modified RBAC Objects severity medium T1098, T1098.006

delete-clusterrolebindings

5 detection rules reference this event. View event page.

Sigma (2)

Google Cloud Kubernetes RoleBinding severity medium
Kubernetes Rolebinding Modification severity medium

Elastic (2)

GKE Service Account Modified RBAC Objects severity medium T1098, T1098.006
Kubernetes Service Account Modified RBAC Objects severity medium T1098, T1098.006

Falco (1)

K8s ClusterRoleBinding Deleted severity INFO

any-clusterrolebindings

1 detection rules reference this event. View event page.

Elastic (1)

Kubernetes Multi-Resource Discovery severity medium T1613