Google Cloud Kubernetes RoleBinding Activity

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•35

Detects the creation, modification, or deletion of Kubernetes RoleBindings and ClusterRoleBindings in Google Cloud. These actions can indicate an adversary attempting to escalate privileges or maintain persistence within a Kubernetes cluster by granting themselves or other accounts additional roles and permissions.