in-cluster controllers, operators, and ci jobs may legitimately reconcile rbac manifests. baseline known automation service accounts before tuning.

Techniques

T1098

Sample rules

GKE Service Account Modified RBAC Objects

source: elastic
technicques:
- T1098

Description

Detects write operations performed by GKE service accounts against RBAC resources (Roles, ClusterRoles, RoleBindings, ClusterRoleBindings). Service accounts typically do not manage RBAC directly; this activity may indicate token abuse or unauthorized privilege escalation.

Detection logic

data_stream.dataset:gcp.audit and service.name:"k8s.io" and event.outcome:success and
client.user.email:(system\:serviceaccount\:* and not (
  "system:serviceaccount:kube-system:clusterrole-aggregation-controller" or
  "system:serviceaccount:kube-system:generic-garbage-collector"
)) and event.action:(
  "io.k8s.authorization.rbac.v1.clusterrolebindings.create" or
  "io.k8s.authorization.rbac.v1.clusterrolebindings.delete" or
  "io.k8s.authorization.rbac.v1.clusterrolebindings.patch" or
  "io.k8s.authorization.rbac.v1.clusterrolebindings.update" or
  "io.k8s.authorization.rbac.v1.clusterroles.create" or
  "io.k8s.authorization.rbac.v1.clusterroles.delete" or
  "io.k8s.authorization.rbac.v1.clusterroles.patch" or
  "io.k8s.authorization.rbac.v1.clusterroles.update" or
  "io.k8s.authorization.rbac.v1.rolebindings.create" or
  "io.k8s.authorization.rbac.v1.rolebindings.delete" or
  "io.k8s.authorization.rbac.v1.rolebindings.patch" or
  "io.k8s.authorization.rbac.v1.rolebindings.update" or
  "io.k8s.authorization.rbac.v1.roles.create" or
  "io.k8s.authorization.rbac.v1.roles.delete" or
  "io.k8s.authorization.rbac.v1.roles.patch" or
  "io.k8s.authorization.rbac.v1.roles.update"
)