Kubernetes Sensitive RBAC Change Followed by Workload Modification

Last updated 4 days ago on 2026-09-18

Created 8 months ago on 2026-02-04

About

Detects a sequence where a principal creates or modifies a Role/ClusterRole to include high-risk permissions (e.g., wildcard access or escalation verbs) and then creates or patches a workload resource (DaemonSet, Deployment, or CronJob) shortly after, which may indicate RBAC-based privilege escalation followed by payload deployment. This pattern is often used by adversaries to gain unauthorized access to sensitive resources and deploy malicious payloads.

Tags

Data Source: KubernetesData Source: Kubernetes API Server Audit LogsDomain: ContainersDomain: KubernetesPlatform: KubernetesUse Case: Threat DetectionTactic: Privilege EscalationTactic: PersistenceRule Type: Event Correlation (EQL)Noise: HighPerformance: FastProfile: AggressiveDomain: CloudLanguage: eql

Severity

medium

Risk Score

MITRE ATT&CK™

Privilege Escalation (TA0004)(external, opens in a new tab or window)

↳ Account Manipulation (T1098)(external, opens in a new tab or window)

Persistence (TA0003)(external, opens in a new tab or window)

↳ Account Manipulation (T1098)(external, opens in a new tab or window)

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: Event Correlation Rule
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: logs-kubernetes.audit_logs-*
Related Integrations: kubernetes(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗sequence by user.name with maxspan=5m
  [any where data_stream.dataset == "kubernetes.audit_logs" and
   `kubernetes.audit.annotations.authorization_k8s_io/decision` == "allow" and
    kubernetes.audit.objectRef.resource in ("roles", "clusterroles") and
    kubernetes.audit.verb in ("create", "update", "patch") and
    /* GitOps controllers reconcile RBAC then workloads in the same window */
    not user.name in (
      "system:serviceaccount:flux-system:kustomize-controller",
      "system:serviceaccount:flux-system:helm-controller",
      "system:serviceaccount:flux-system:source-controller"
    )]
  [any where data_stream.dataset == "kubernetes.audit_logs" and
   `kubernetes.audit.annotations.authorization_k8s_io/decision` == "allow" and
    kubernetes.audit.objectRef.resource in ("daemonsets", "deployments", "cronjobs") and
    kubernetes.audit.verb in ("create", "patch") and
    /* reduce control-plane / bootstrap noise */
    not kubernetes.audit.user.groups == "system:masters"
  ]

Install detection rules in Elastic Security

Detect Kubernetes Sensitive RBAC Change Followed by Workload Modification in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).