Detect Additional Container Cluster Roles in Microsoft Sentinel
An adversary may add additional roles or permissions to an adversary-controlled user or service account to maintain persistent access to a container orchestration system. For example, an adversary with sufficient permissions may create a RoleBinding or ClusterRoleBinding to bind a Role or ClusterRole to a Kubernetes account. Where ABAC is in use, an adversary may modify a Kubernetes ABAC policy to give the target account additional permissions. This technique may also be used in conjunction with cloud-based RBAC assignments in managed Kubernetes services such as GKE, EKS, and AKS.
MITRE ATT&CK
- Tactic
- Persistence Privilege Escalation
- Technique
- T1098 Account Manipulation
- Sub-technique
- T1098.006 Additional Container Cluster Roles
- Canonical reference
- https://attack.mitre.org/techniques/T1098/006/
KQL Detection Query
// Detect creation or modification of Kubernetes RBAC bindings and privilege escalation in container clusters
// Covers Azure Kubernetes Service (AKS) via AzureActivity and AzureDiagnostics, plus Defender for Containers
let SuspiciousRBACOperations = dynamic([
"Microsoft.ContainerService/managedClusters/rbac.authorization.k8s.io/clusterrolebindings/write",
"Microsoft.ContainerService/managedClusters/rbac.authorization.k8s.io/rolebindings/write",
"Microsoft.ContainerService/managedClusters/rbac.authorization.k8s.io/clusterroles/write",
"Microsoft.ContainerService/managedClusters/rbac.authorization.k8s.io/roles/write"
]);
let HighPrivilegeRoles = dynamic([
"cluster-admin", "admin", "edit", "system:masters"
]);
// AKS Control Plane Audit Logs
AzureDiagnostics
| where TimeGenerated > ago(24h)
| where Category == "kube-audit" or Category == "kube-audit-admin"
| extend LogEntry = parse_json(log_s)
| extend
Verb = tostring(LogEntry.verb),
Resource = tostring(LogEntry.objectRef.resource),
ResourceName = tostring(LogEntry.objectRef.name),
Namespace = tostring(LogEntry.objectRef.namespace),
UserName = tostring(LogEntry.user.username),
UserGroups = tostring(LogEntry.user.groups),
SourceIP = tostring(LogEntry.sourceIPs[0]),
UserAgent = tostring(LogEntry.userAgent),
RequestURI = tostring(LogEntry.requestURI),
ResponseCode = toint(LogEntry.responseStatus.code)
| where Verb in ("create", "update", "patch")
| where Resource in ("clusterrolebindings", "rolebindings", "clusterroles", "roles")
| where ResponseCode between (200 .. 299)
| extend RequestObject = tostring(LogEntry.requestObject)
| extend IsSensitiveRole = RequestObject has_any (HighPrivilegeRoles)
| extend IsServiceAccount = UserName startswith "system:serviceaccount:"
| extend IsSystemUser = UserName startswith "system:"
| where not (IsSystemUser and not IsServiceAccount)
| project
TimeGenerated,
Verb,
Resource,
ResourceName,
Namespace,
UserName,
UserGroups,
SourceIP,
UserAgent,
IsSensitiveRole,
IsServiceAccount,
RequestObject,
ResponseCode,
ResourceId
| sort by TimeGenerated descDetects creation or modification of Kubernetes RBAC objects (ClusterRoleBindings, RoleBindings, ClusterRoles, Roles) via AKS audit logs in AzureDiagnostics. Identifies privilege escalation attempts including binding to high-privilege roles such as cluster-admin. Filters out expected system-level operations while flagging service account modifications and sensitive role bindings. Requires AKS diagnostic settings with kube-audit or kube-audit-admin category enabled and sent to Log Analytics.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate cluster administrators creating or updating RBAC bindings as part of normal operations or infrastructure-as-code deployments (Terraform, Helm, ArgoCD)
- CI/CD pipelines (GitHub Actions, Jenkins, GitLab CI) that apply RBAC manifests during application deployment
- Kubernetes operators and controllers (e.g., cert-manager, Prometheus operator) that create their own service account role bindings during installation
- Cluster upgrades or managed add-on installations by the cloud provider that temporarily create or modify RBAC objects
Other platforms for T1098.006
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Create Privileged ClusterRoleBinding for Service Account
Expected signal: Kubernetes API server audit log: verb=create, objectRef.resource=clusterrolebindings, objectRef.name=attacker-cluster-admin-binding, responseStatus.code=201. Second audit event for serviceaccounts create. The requestObject will contain roleRef.name=cluster-admin and subjects referencing the service account.
- Test 2Create Namespace-Scoped RoleBinding for External User
Expected signal: Kubernetes API server audit log: verb=create, objectRef.resource=rolebindings, objectRef.namespace=attacker-test-ns, objectRef.name=attacker-ns-admin-binding, responseStatus.code=201. The requestObject includes roleRef.name=admin and subjects with kind=User and [email protected].
- Test 3Modify Existing ClusterRole to Add Wildcard Permissions
Expected signal: Kubernetes API server audit log: verb=patch, objectRef.resource=clusterroles, objectRef.name=attacker-test-role, responseStatus.code=200. The requestObject contains JSON patch operations adding wildcard rules. This differs from 'create' operations and may be missed by detections that only look for verb=create.
- Test 4Create ABAC Policy Entry via ConfigMap Modification
Expected signal: Kubernetes API server audit log: verb=create, objectRef.resource=configmaps, objectRef.name=attacker-abac-policy. If this were a real kube-system ABAC policy modification: verb=update/patch, objectRef.resource=configmaps, objectRef.namespace=kube-system. The ConfigMap data contains ABAC policy JSON granting wildcard permissions.
References (12)
- https://attack.mitre.org/techniques/T1098/006/
- https://kubernetes.io/docs/reference/access-authn-authz/rbac/
- https://kubernetes.io/docs/reference/access-authn-authz/abac/
- https://kubernetes.io/docs/concepts/security/rbac-good-practices/
- https://blog.aquasec.com/leveraging-kubernetes-rbac-to-backdoor-clusters
- https://cloud.google.com/kubernetes-engine/docs/how-to/iam
- https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html
- https://learn.microsoft.com/en-us/azure/aks/concepts-identity
- https://learn.microsoft.com/en-us/azure/aks/monitor-aks
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1098.006/T1098.006.md
- https://www.cncf.io/blog/2021/07/06/practical-approach-to-kubernetes-audit-logging/
- https://cheatsheetseries.owasp.org/cheatsheets/Kubernetes_Security_Cheat_Sheet.html
Unlock Pro Content
Get the full detection package for T1098.006 including response playbook, investigation guide, and atomic red team tests.