Kubernetes Rolebinding or ClusterRolebinding Modification

SigmaHQ Detections@sigmaHQ

•updated Jun 2, 2025•0•33

Detects when a Kubernetes RoleBinding or ClusterRoleBinding is created, modified, or deleted. This activity can indicate privilege escalation attempts or unauthorized access within a Kubernetes cluster.