Azure Kubernetes RoleBinding/ClusterRoleBinding Modified or Deleted

SigmaHQ Detections@sigmaHQ

•updated Jun 4, 2025•0•25

Detects the modification or deletion of Kubernetes RoleBindings or ClusterRoleBindings within Azure Kubernetes Service. These actions can indicate an adversary attempting to escalate privileges, maintain persistence, or disrupt services by altering access control configurations.