Detection rules › Falco
System ClusterRole Modified/Deleted
Detect any attempt to modify/delete a ClusterRole/Role starting with system
Telemetry coverage
Rules detecting the same action
These rules filter on the same operation.
- ClusterRole With Pod Exec Created (Falco)
- ClusterRole With Wildcard Created (Falco)
- ClusterRole With Write Privileges Created (Falco)
- Direct Interactive Kubernetes API Request by Unusual Utilities (Elastic)
- GKE Creation or Modification of Sensitive Role (Elastic)
- GKE RBAC Wildcard Elevation on Existing Role (Elastic)
- GKE Sensitive RBAC Change Followed by Workload Modification (Elastic)
- GKE Service Account Modified RBAC Objects (Elastic)
Stages and Predicates
Stage 1: falco_condition
and
not
objectRef.name in ["system:coredns", "system:managed-certificate-controller"]
or
objectRef.resource eq "clusterroles"
objectRef.resource eq "roles"
or
verb eq "delete"
verb in ["create", "patch", "update"]
objectRef.name starts_with "system:"
stage eq "ResponseComplete"
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
objectRef.name | in | system:coredns, system:managed-certificate-controller | excludes:objectRef.name field:"objectRef.name" value:"system:coredns" field:"objectRef.name" value:"system:managed-certificate-controller" |
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
objectRef.name | starts_with |
| field:"objectRef.name" kind:starts_with value:"system:" |
objectRef.resource | eq |
| field:"objectRef.resource" kind:eq |
stage | in |
| field:"stage" kind:in value:"ResponseComplete" |
verb | eq |
| field:"verb" kind:eq value:"delete" |
verb | in |
| field:"verb" kind:in |