LoFP LoFP / platform installers, gitops controllers, and rbac refactoring may legitimately create roles with broad permissions. baseline approved automation and tune exclusions for known operators.

Techniques

Sample rules

GKE Creation or Modification of Sensitive Role

Description

Detects creation or modification of GKE Roles or ClusterRoles that grant high-risk permissions, such as wildcard access or RBAC escalation verbs (bind, escalate, impersonate), which may enable privilege escalation or unauthorized access within the cluster.

Detection logic

data_stream.dataset:gcp.audit and service.name:"k8s.io" and event.outcome:success and
event.action:(
  "io.k8s.authorization.rbac.v1.roles.create" or
  "io.k8s.authorization.rbac.v1.roles.update" or
  "io.k8s.authorization.rbac.v1.roles.patch" or
  "io.k8s.authorization.rbac.v1.clusterroles.create" or
  "io.k8s.authorization.rbac.v1.clusterroles.update" or
  "io.k8s.authorization.rbac.v1.clusterroles.patch"
) and not source.ip:("::1" or "127.0.0.1") and not (
  client.user.email:"system:serviceaccount:kube-system:clusterrole-aggregation-controller" and
  gcp.audit.request.metadata.name:(admin or edit) and
  event.action:"io.k8s.authorization.rbac.v1.clusterroles.patch"
) and not (
  client.user.email:"system:addon-manager" and
  event.action:(
    "io.k8s.authorization.rbac.v1.roles.patch" or
    "io.k8s.authorization.rbac.v1.clusterroles.patch"
  )
) and (
  gcp.audit.request.rules.verbs:("*" or escalate or bind or impersonate) or
  (
    gcp.audit.request.rules.verbs:("*" or create or patch or update) and
    gcp.audit.request.rules.resources:(
      "*" or clusterroles or clusterrolebindings or roles or rolebindings or
      pods/exec or serviceaccounts/token or nodes/proxy or daemonsets
    )
  ) or
  (
    gcp.audit.request.rules.verbs:("*" or get or list) and
    gcp.audit.request.rules.resources:("*" or secrets)
  ) or
  gcp.audit.response.rules.verbs:("*" or escalate or bind or impersonate) or
  (
    gcp.audit.response.rules.verbs:("*" or create or patch or update) and
    gcp.audit.response.rules.resources:(
      "*" or clusterroles or clusterrolebindings or roles or rolebindings or
      pods/exec or serviceaccounts/token or nodes/proxy or daemonsets
    )
  ) or
  (
    gcp.audit.response.rules.verbs:("*" or get or list) and
    gcp.audit.response.rules.resources:("*" or secrets)
  )
)