Detection rules › By event

Kubernetes-clusterroles

Event	Rules
get-clusterroles	2
list-clusterroles	2
watch-clusterroles	1
create-clusterroles	16
update-clusterroles	11
patch-clusterroles	11
delete-clusterroles	5
any-clusterroles	1

get-clusterroles

2 detection rules reference this event. View event page.

Elastic (2)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
GKE Multi-Resource Discovery severity medium T1613

list-clusterroles

2 detection rules reference this event. View event page.

Elastic (2)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
GKE Multi-Resource Discovery severity medium T1613

watch-clusterroles

1 detection rules reference this event. View event page.

Elastic (1)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610

create-clusterroles

16 detection rules reference this event. View event page.

Elastic (7)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
GKE Creation or Modification of Sensitive Role severity medium T1098, T1098.006
GKE Sensitive RBAC Change Followed by Workload Modification severity medium T1098, T1098.006
GKE Service Account Modified RBAC Objects severity medium T1098, T1098.006
Kubernetes Creation or Modification of Sensitive Role severity medium T1098, T1098.006
Kubernetes Sensitive RBAC Change Followed by Workload Modification severity medium T1098, T1098.006
Kubernetes Service Account Modified RBAC Objects severity medium T1098, T1098.006

Panther (4)

Kubernetes Role With Node Proxy Permissions Created severity high T1078.004, T1685
Kubernetes Role With Pod Exec Permissions Created severity high T1021, T1078.004
Kubernetes Role With Wildcard Permissions Created severity high T1078.004
Kubernetes Role With Write Permissions Created severity low T1222

Falco (5)

ClusterRole With Pod Exec Created severity WARNING
ClusterRole With Wildcard Created severity WARNING
ClusterRole With Write Privileges Created severity NOTICE
K8s ClusterRole Created severity INFO
System ClusterRole Modified/Deleted severity WARNING

update-clusterroles

11 detection rules reference this event. View event page.

Elastic (9)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
GKE Creation or Modification of Sensitive Role severity medium T1098, T1098.006
GKE RBAC Wildcard Elevation on Existing Role severity high T1098, T1098.006
GKE Sensitive RBAC Change Followed by Workload Modification severity medium T1098, T1098.006
GKE Service Account Modified RBAC Objects severity medium T1098, T1098.006
Kubernetes Creation or Modification of Sensitive Role severity medium T1098, T1098.006
Kubernetes RBAC Wildcard Elevation on Existing Role severity high T1098, T1098.006
Kubernetes Sensitive RBAC Change Followed by Workload Modification severity medium T1098, T1098.006
Kubernetes Service Account Modified RBAC Objects severity medium T1098, T1098.006

Panther (1)

Kubernetes System Role Modified or Deleted severity critical T1078.004, T1098, T1222

Falco (1)

System ClusterRole Modified/Deleted severity WARNING

patch-clusterroles

11 detection rules reference this event. View event page.

Elastic (9)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
GKE Creation or Modification of Sensitive Role severity medium T1098, T1098.006
GKE RBAC Wildcard Elevation on Existing Role severity high T1098, T1098.006
GKE Sensitive RBAC Change Followed by Workload Modification severity medium T1098, T1098.006
GKE Service Account Modified RBAC Objects severity medium T1098, T1098.006
Kubernetes Creation or Modification of Sensitive Role severity medium T1098, T1098.006
Kubernetes RBAC Wildcard Elevation on Existing Role severity high T1098, T1098.006
Kubernetes Sensitive RBAC Change Followed by Workload Modification severity medium T1098, T1098.006
Kubernetes Service Account Modified RBAC Objects severity medium T1098, T1098.006

Panther (1)

Kubernetes System Role Modified or Deleted severity critical T1078.004, T1098, T1222

Falco (1)

System ClusterRole Modified/Deleted severity WARNING

delete-clusterroles

5 detection rules reference this event. View event page.

Elastic (2)

GKE Service Account Modified RBAC Objects severity medium T1098, T1098.006
Kubernetes Service Account Modified RBAC Objects severity medium T1098, T1098.006

Panther (1)

Kubernetes System Role Modified or Deleted severity critical T1078.004, T1098, T1222

Falco (2)

K8s ClusterRole Deleted severity INFO
System ClusterRole Modified/Deleted severity WARNING

any-clusterroles

1 detection rules reference this event. View event page.

Elastic (1)

Kubernetes Multi-Resource Discovery severity medium T1613