Detection rules › Falco
ClusterRole With Wildcard Created
Detect any attempt to create a Role/ClusterRole with wildcard resources or verbs
Telemetry coverage
| Platform | Record / event type |
|---|---|
| Kubernetes | create-clusterroles: create clusterroles |
| Kubernetes | create-roles: create roles |
Rules detecting the same action
These rules filter on the same operation.
- ClusterRole With Pod Exec Created (Falco)
- ClusterRole With Write Privileges Created (Falco)
- Direct Interactive Kubernetes API Request by Unusual Utilities (Elastic)
- GKE Creation or Modification of Sensitive Role (Elastic)
- GKE Sensitive RBAC Change Followed by Workload Modification (Elastic)
- GKE Service Account Modified RBAC Objects (Elastic)
- K8s ClusterRole Created (Falco)
- K8s Role Created (Falco)
Stages and Predicates
Stage 1: falco_condition
and
or
objectRef.resource eq "clusterroles"
objectRef.resource eq "roles"
or
requestObject.role.rules.resources eq "*"
requestObject.role.rules.verbs eq "*"
stage eq "ResponseComplete"
verb eq "create"
Indicators
These rows show field, operator, and value matches.