Kubernetes Cluster-Admin Role Binding Created

This rule detects the creation of a RoleBinding or ClusterRoleBinding that grants the cluster-admin ClusterRole, which provides unrestricted access to all Kubernetes resources and represents a high-risk privilege escalation or misconfiguration.

Rule type: query
Rule indices:

• logs-kubernetes.audit_logs-*

Rule Severity: medium
Risk Score: 47
Runs every:
Searches indices from: ``
Maximum alerts per execution: 100
References:

• https://heilancoos.github.io/research/2025/12/16/kubernetes.html#overly-permissive-role-based-access-control

Tags:

• Data Source: Kubernetes
• Domain: Kubernetes
• Use Case: Threat Detection
• Tactic: Persistence
• Tactic: Privilege Escalation

Version: 1
Rule authors:

• Elastic

Rule license: Elastic License v2

event.dataset: "kubernetes.audit_logs" and kubernetes.audit.objectRef.resource:("clusterrolebindings" or "rolebindings") and
kubernetes.audit.verb:"create" and kubernetes.audit.requestObject.roleRef.name:"cluster-admin" and
kubernetes.audit.annotations.authorization_k8s_io/decision:"allow" and
kubernetes.audit.level:"RequestResponse" and kubernetes.audit.stage:"ResponseComplete"
		

Framework: MITRE ATT&CK

• Tactic:

  • Name: Persistence
  • Id: TA0003
  • Reference URL: https://attack.mitre.org/tactics/TA0003/

• Technique:

  • Name: Account Manipulation
  • Id: T1098
  • Reference URL: https://attack.mitre.org/techniques/T1098/

• Sub Technique:

  • Name: Additional Container Cluster Roles
  • Id: T1098.006
  • Reference URL: https://attack.mitre.org/techniques/T1098/006/

Framework: MITRE ATT&CK

• Tactic:

  • Name: Privilege Escalation
  • Id: TA0004
  • Reference URL: https://attack.mitre.org/tactics/TA0004/

• Technique:

  • Name: Account Manipulation
  • Id: T1098
  • Reference URL: https://attack.mitre.org/techniques/T1098/

• Sub Technique:

  • Name: Additional Container Cluster Roles
  • Id: T1098.006
  • Reference URL: https://attack.mitre.org/techniques/T1098/006/