Container Cluster Role Binding Created for Persistence

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects the creation of a cluster role binding in a Kubernetes environment, specifically looking for HTTP POST requests to the Kubernetes API server's rbac.authorization.k8s.io endpoint for 'rolebindings'. This activity can indicate an attempt to establish persistence within the cluster by granting specific permissions to an identity.