Detection rules › By event

Kubernetes-roles

Event	Rules
get-roles	2
list-roles	2
watch-roles	1
create-roles	16
update-roles	11
patch-roles	11
delete-roles	5
any-roles	1

get-roles

2 detection rules reference this event. View event page.

Elastic (2)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
GKE Multi-Resource Discovery severity medium T1613

list-roles

2 detection rules reference this event. View event page.

Elastic (2)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
GKE Multi-Resource Discovery severity medium T1613

watch-roles

1 detection rules reference this event. View event page.

Elastic (1)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610

create-roles

16 detection rules reference this event. View event page.

Elastic (7)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
GKE Creation or Modification of Sensitive Role severity medium T1098, T1098.006
GKE Sensitive RBAC Change Followed by Workload Modification severity medium T1098, T1098.006
GKE Service Account Modified RBAC Objects severity medium T1098, T1098.006
Kubernetes Creation or Modification of Sensitive Role severity medium T1098, T1098.006
Kubernetes Sensitive RBAC Change Followed by Workload Modification severity medium T1098, T1098.006
Kubernetes Service Account Modified RBAC Objects severity medium T1098, T1098.006

Panther (4)

Kubernetes Role With Node Proxy Permissions Created severity high T1078.004, T1685
Kubernetes Role With Pod Exec Permissions Created severity high T1021, T1078.004
Kubernetes Role With Wildcard Permissions Created severity high T1078.004
Kubernetes Role With Write Permissions Created severity low T1222

Falco (5)

ClusterRole With Pod Exec Created severity WARNING
ClusterRole With Wildcard Created severity WARNING
ClusterRole With Write Privileges Created severity NOTICE
K8s Role Created severity INFO
System ClusterRole Modified/Deleted severity WARNING

update-roles

11 detection rules reference this event. View event page.

Elastic (9)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
GKE Creation or Modification of Sensitive Role severity medium T1098, T1098.006
GKE RBAC Wildcard Elevation on Existing Role severity high T1098, T1098.006
GKE Sensitive RBAC Change Followed by Workload Modification severity medium T1098, T1098.006
GKE Service Account Modified RBAC Objects severity medium T1098, T1098.006
Kubernetes Creation or Modification of Sensitive Role severity medium T1098, T1098.006
Kubernetes RBAC Wildcard Elevation on Existing Role severity high T1098, T1098.006
Kubernetes Sensitive RBAC Change Followed by Workload Modification severity medium T1098, T1098.006
Kubernetes Service Account Modified RBAC Objects severity medium T1098, T1098.006

Panther (1)

Kubernetes System Role Modified or Deleted severity critical T1078.004, T1098, T1222

Falco (1)

System ClusterRole Modified/Deleted severity WARNING

patch-roles

11 detection rules reference this event. View event page.

Elastic (9)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
GKE Creation or Modification of Sensitive Role severity medium T1098, T1098.006
GKE RBAC Wildcard Elevation on Existing Role severity high T1098, T1098.006
GKE Sensitive RBAC Change Followed by Workload Modification severity medium T1098, T1098.006
GKE Service Account Modified RBAC Objects severity medium T1098, T1098.006
Kubernetes Creation or Modification of Sensitive Role severity medium T1098, T1098.006
Kubernetes RBAC Wildcard Elevation on Existing Role severity high T1098, T1098.006
Kubernetes Sensitive RBAC Change Followed by Workload Modification severity medium T1098, T1098.006
Kubernetes Service Account Modified RBAC Objects severity medium T1098, T1098.006

Panther (1)

Kubernetes System Role Modified or Deleted severity critical T1078.004, T1098, T1222

Falco (1)

System ClusterRole Modified/Deleted severity WARNING

delete-roles

5 detection rules reference this event. View event page.

Elastic (2)

GKE Service Account Modified RBAC Objects severity medium T1098, T1098.006
Kubernetes Service Account Modified RBAC Objects severity medium T1098, T1098.006

Panther (1)

Kubernetes System Role Modified or Deleted severity critical T1078.004, T1098, T1222

Falco (2)

K8s Role Deleted severity INFO
System ClusterRole Modified/Deleted severity WARNING

any-roles

1 detection rules reference this event. View event page.

Elastic (1)

Kubernetes Multi-Resource Discovery severity medium T1613