Azure Kubernetes Sensitive Role Access Modification

SigmaHQ Detections@sigmaHQ

•updated Jun 4, 2025•0•33

This rule identifies when sensitive ClusterRoles or Roles are being modified, deleted, or when their permissions are being escalated or bound in Azure Kubernetes Service (AKS). These operations can indicate an attempt to gain elevated privileges or disrupt access within the Kubernetes cluster.