Detection rules › By event

Kubernetes-rolebindings

Event	Rules
get-rolebindings	2
list-rolebindings	2
watch-rolebindings	1
create-rolebindings	9
update-rolebindings	5
patch-rolebindings	5
delete-rolebindings	5
any-rolebindings	1

get-rolebindings

2 detection rules reference this event. View event page.

Elastic (2)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
GKE Multi-Resource Discovery severity medium T1613

list-rolebindings

2 detection rules reference this event. View event page.

Elastic (2)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
GKE Multi-Resource Discovery severity medium T1613

watch-rolebindings

1 detection rules reference this event. View event page.

Elastic (1)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610

create-rolebindings

9 detection rules reference this event. View event page.

Sigma (2)

Google Cloud Kubernetes RoleBinding severity medium
Kubernetes Rolebinding Modification severity medium

Elastic (6)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
GKE Creation of a RoleBinding Referencing a ServiceAccount severity medium T1098, T1098.006
GKE Service Account Modified RBAC Objects severity medium T1098, T1098.006
Kubernetes Cluster-Admin Role Binding Created severity medium T1098, T1098.006
Kubernetes Creation of a RoleBinding Referencing a ServiceAccount severity medium T1098, T1098.006
Kubernetes Service Account Modified RBAC Objects severity medium T1098, T1098.006

Falco (1)

K8s RoleBinding Created severity INFO

update-rolebindings

5 detection rules reference this event. View event page.

Sigma (2)

Google Cloud Kubernetes RoleBinding severity medium
Kubernetes Rolebinding Modification severity medium

Elastic (3)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
GKE Service Account Modified RBAC Objects severity medium T1098, T1098.006
Kubernetes Service Account Modified RBAC Objects severity medium T1098, T1098.006

patch-rolebindings

5 detection rules reference this event. View event page.

Sigma (2)

Google Cloud Kubernetes RoleBinding severity medium
Kubernetes Rolebinding Modification severity medium

Elastic (3)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
GKE Service Account Modified RBAC Objects severity medium T1098, T1098.006
Kubernetes Service Account Modified RBAC Objects severity medium T1098, T1098.006

delete-rolebindings

5 detection rules reference this event. View event page.

Sigma (2)

Google Cloud Kubernetes RoleBinding severity medium
Kubernetes Rolebinding Modification severity medium

Elastic (2)

GKE Service Account Modified RBAC Objects severity medium T1098, T1098.006
Kubernetes Service Account Modified RBAC Objects severity medium T1098, T1098.006

Falco (1)

K8s RoleBinding Deleted severity INFO

any-rolebindings

1 detection rules reference this event. View event page.

Elastic (1)

Kubernetes Multi-Resource Discovery severity medium T1613