Detection rules › By catalog entry

Kubernetes-rolebindings

Catalog entry	Rules
get-rolebindings	2
list-rolebindings	2
watch-rolebindings	1
create-rolebindings	8
update-rolebindings	5
patch-rolebindings	5
delete-rolebindings	4
any-rolebindings	1

get-rolebindings

2 detection rules reference this catalog entry. View catalog entry.

Elastic (2)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059,T1059.004,T1069,T1087,T1609,T1610
GKE Multi-Resource Discovery severity medium T1613

list-rolebindings

2 detection rules reference this catalog entry. View catalog entry.

Elastic (2)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059,T1059.004,T1069,T1087,T1609,T1610
GKE Multi-Resource Discovery severity medium T1613

watch-rolebindings

1 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059,T1059.004,T1069,T1087,T1609,T1610

create-rolebindings

8 detection rules reference this catalog entry. View catalog entry.

Sigma (2)

Google Cloud Kubernetes RoleBinding severity medium
Kubernetes Rolebinding Modification severity medium

Elastic (6)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059,T1059.004,T1069,T1087,T1609,T1610
GKE Creation of a RoleBinding Referencing a ServiceAccount severity medium T1098,T1098.006
GKE Service Account Modified RBAC Objects severity medium T1098,T1098.006
Kubernetes Cluster-Admin Role Binding Created severity medium T1098,T1098.006
Kubernetes Creation of a RoleBinding Referencing a ServiceAccount severity medium T1098,T1098.006
Kubernetes Service Account Modified RBAC Objects severity medium T1098,T1098.006

update-rolebindings

5 detection rules reference this catalog entry. View catalog entry.

Sigma (2)

Google Cloud Kubernetes RoleBinding severity medium
Kubernetes Rolebinding Modification severity medium

Elastic (3)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059,T1059.004,T1069,T1087,T1609,T1610
GKE Service Account Modified RBAC Objects severity medium T1098,T1098.006
Kubernetes Service Account Modified RBAC Objects severity medium T1098,T1098.006

patch-rolebindings

5 detection rules reference this catalog entry. View catalog entry.

Sigma (2)

Google Cloud Kubernetes RoleBinding severity medium
Kubernetes Rolebinding Modification severity medium

Elastic (3)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059,T1059.004,T1069,T1087,T1609,T1610
GKE Service Account Modified RBAC Objects severity medium T1098,T1098.006
Kubernetes Service Account Modified RBAC Objects severity medium T1098,T1098.006

delete-rolebindings

4 detection rules reference this catalog entry. View catalog entry.

Sigma (2)

Google Cloud Kubernetes RoleBinding severity medium
Kubernetes Rolebinding Modification severity medium

Elastic (2)

GKE Service Account Modified RBAC Objects severity medium T1098,T1098.006
Kubernetes Service Account Modified RBAC Objects severity medium T1098,T1098.006

any-rolebindings

1 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

Kubernetes Multi-Resource Discovery severity medium T1613

Back to all Kubernetes-rolebindings catalog entries