GKE Cluster-Admin Role Binding Created or Modified

Detects creation or modification of a GKE ClusterRoleBinding that grants the cluster-admin ClusterRole, providing unrestricted cluster access and enabling rapid privilege escalation or persistence.

Rule type: query
Rule indices:

• logs-gcp.audit-*

Rule Severity: medium
Risk Score: 47
Runs every:
Searches indices from: ``
Maximum alerts per execution: 100
References:

• https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control
• https://heilancoos.github.io/research/2025/12/16/kubernetes.html#overly-permissive-role-based-access-control

Tags:

• Domain: Cloud
• Domain: Kubernetes
• Data Source: GCP
• Data Source: Google Cloud Platform
• Use Case: Threat Detection
• Tactic: Persistence
• Tactic: Privilege Escalation
• Resources: Investigation Guide

Version: 2
Rule authors:

• Elastic

Rule license: Elastic License v2
The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule.

Identify who created or changed the binding and which subject received cluster-admin.

• Review client.user.email, source.ip, and gcp.audit.request for the bound subject.
• Hunt for secret reads, privileged pod creation, or webhook changes from the same actor or new subject.

• Bootstrap and recovery may recreate cluster-admin bindings via system:apiserver during control plane reconciliation (excluded).

data_stream.dataset:gcp.audit and service.name:"k8s.io" and event.outcome:success and
event.action:(
  "io.k8s.authorization.rbac.v1.clusterrolebindings.create" or
  "io.k8s.authorization.rbac.v1.clusterrolebindings.patch" or
  "io.k8s.authorization.rbac.v1.clusterrolebindings.update"
) and gcp.audit.request.kind:"ClusterRoleBinding" and
gcp.audit.resource_name:"rbac.authorization.k8s.io/v1/clusterrolebindings/cluster-admin" and
not client.user.email:"system:apiserver"
		

Framework: MITRE ATT&CK

• Tactic:

  • Name: Persistence
  • Id: TA0003
  • Reference URL: https://attack.mitre.org/tactics/TA0003/

• Technique:

  • Name: Account Manipulation
  • Id: T1098
  • Reference URL: https://attack.mitre.org/techniques/T1098/

• Sub Technique:

  • Name: Additional Container Cluster Roles
  • Id: T1098.006
  • Reference URL: https://attack.mitre.org/techniques/T1098/006/

Framework: MITRE ATT&CK

• Tactic:

  • Name: Privilege Escalation
  • Id: TA0004
  • Reference URL: https://attack.mitre.org/tactics/TA0004/

• Technique:

  • Name: Account Manipulation
  • Id: T1098
  • Reference URL: https://attack.mitre.org/techniques/T1098/

• Sub Technique:

  • Name: Additional Container Cluster Roles
  • Id: T1098.006
  • Reference URL: https://attack.mitre.org/techniques/T1098/006/