gitops, namespace onboarding, and workload deployment commonly create rolebindings for service accounts. default bootstrap bindings from `system:apiserver` and gke node bootstrap from `gcp:kube-bootstrap` are excluded.

t1098
gcp
elastic

Techniques

T1098

Sample rules

GKE Creation of a RoleBinding Referencing a ServiceAccount

source: elastic
technicques:
- T1098

Description

Detects creation of a GKE RoleBinding or ClusterRoleBinding that grants permissions to a ServiceAccount, which may indicate privilege delegation or RBAC misconfiguration leading to elevated access.

Detection logic

data_stream.dataset:gcp.audit and service.name:"k8s.io" and event.outcome:success and
event.action:(
  "io.k8s.authorization.rbac.v1.rolebindings.create" or
  "io.k8s.authorization.rbac.v1.clusterrolebindings.create"
) and gcp.audit.request.subjects.kind:"ServiceAccount" and not client.user.email:(
  "system:apiserver" or
  "gcp:kube-bootstrap"
)