Detection rules › By event

Kubernetes-clusterrolebindings

Event	Rules
get-clusterrolebindings	2
list-clusterrolebindings	2
watch-clusterrolebindings	1
create-clusterrolebindings	10
update-clusterrolebindings	6
patch-clusterrolebindings	6
delete-clusterrolebindings	4
any-clusterrolebindings	1

get-clusterrolebindings

2 detection rules reference this event. View event page.

Elastic (2)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059,T1059.004,T1069,T1087,T1609,T1610
GKE Multi-Resource Discovery severity medium T1613

list-clusterrolebindings

2 detection rules reference this event. View event page.

Elastic (2)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059,T1059.004,T1069,T1087,T1609,T1610
GKE Multi-Resource Discovery severity medium T1613

watch-clusterrolebindings

1 detection rules reference this event. View event page.

Elastic (1)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059,T1059.004,T1069,T1087,T1609,T1610

create-clusterrolebindings

10 detection rules reference this event. View event page.

Sigma (2)

Google Cloud Kubernetes RoleBinding severity medium
Kubernetes Rolebinding Modification severity medium

Elastic (7)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059,T1059.004,T1069,T1087,T1609,T1610
GKE Cluster-Admin Role Binding Created or Modified severity medium T1098,T1098.006
GKE Creation of a RoleBinding Referencing a ServiceAccount severity medium T1098,T1098.006
GKE Service Account Modified RBAC Objects severity medium T1098,T1098.006
Kubernetes Cluster-Admin Role Binding Created severity medium T1098,T1098.006
Kubernetes Creation of a RoleBinding Referencing a ServiceAccount severity medium T1098,T1098.006
Kubernetes Service Account Modified RBAC Objects severity medium T1098,T1098.006

Panther (1)

Kubernetes ClusterRoleBinding to Privileged Role severity medium T1078.004,T1098

update-clusterrolebindings

6 detection rules reference this event. View event page.

Sigma (2)

Google Cloud Kubernetes RoleBinding severity medium
Kubernetes Rolebinding Modification severity medium

Elastic (4)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059,T1059.004,T1069,T1087,T1609,T1610
GKE Cluster-Admin Role Binding Created or Modified severity medium T1098,T1098.006
GKE Service Account Modified RBAC Objects severity medium T1098,T1098.006
Kubernetes Service Account Modified RBAC Objects severity medium T1098,T1098.006

patch-clusterrolebindings

6 detection rules reference this event. View event page.

Sigma (2)

Google Cloud Kubernetes RoleBinding severity medium
Kubernetes Rolebinding Modification severity medium

Elastic (4)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059,T1059.004,T1069,T1087,T1609,T1610
GKE Cluster-Admin Role Binding Created or Modified severity medium T1098,T1098.006
GKE Service Account Modified RBAC Objects severity medium T1098,T1098.006
Kubernetes Service Account Modified RBAC Objects severity medium T1098,T1098.006

delete-clusterrolebindings

4 detection rules reference this event. View event page.

Sigma (2)

Google Cloud Kubernetes RoleBinding severity medium
Kubernetes Rolebinding Modification severity medium

Elastic (2)

GKE Service Account Modified RBAC Objects severity medium T1098,T1098.006
Kubernetes Service Account Modified RBAC Objects severity medium T1098,T1098.006

any-clusterrolebindings

1 detection rules reference this event. View event page.

Elastic (1)

Kubernetes Multi-Resource Discovery severity medium T1613