Detection rules › Falco
Attach to cluster-admin Role
Detect any attempt to create a ClusterRoleBinding to the cluster-admin user
Telemetry coverage
| Platform | Record / event type |
|---|---|
| Kubernetes | create-clusterrolebindings: create clusterrolebindings |
Rules detecting the same action
These rules filter on the same operation.
- Direct Interactive Kubernetes API Request by Unusual Utilities (Elastic)
- GKE Cluster-Admin Role Binding Created or Modified (Elastic)
- GKE Creation of a RoleBinding Referencing a ServiceAccount (Elastic)
- GKE Service Account Modified RBAC Objects (Elastic)
- Google Cloud Kubernetes RoleBinding (Sigma)
- K8s ClusterRoleBinding Created (Falco)
- Kubernetes Cluster-Admin Role Binding Created (Elastic)
- Kubernetes ClusterRoleBinding to Privileged Role (Panther)
Stages and Predicates
Stage 1: falco_condition
and
objectRef.resource eq "clusterrolebindings"
requestObject.binding.role eq "cluster-admin"
stage eq "ResponseComplete"
verb eq "create"
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
objectRef.resource | eq |
| field:"objectRef.resource" kind:eq value:"clusterrolebindings" |
requestObject.binding.role | eq |
| field:"requestObject.binding.role" kind:eq value:"cluster-admin" |
stage | in |
| field:"stage" kind:in value:"ResponseComplete" |
verb | eq |
| field:"verb" kind:eq value:"create" |