Kubernetes RBAC Privilege Escalation
Detects suspicious Kubernetes Role-Based Access Control (RBAC) changes that grant elevated privileges, such as 'cluster-admin' roles, wildcard permissions for verbs, resources, or API groups, or direct access to secrets or service accounts. This rule monitors 'create', 'update', and 'patch' operations on roles, clusterroles, rolebindings, and clusterrolebindings within Kubernetes audit logs.
Microsoft Sentinel (KQL)
