Kubernetes Cluster Admin Role Binding Created Or Modified

Query

let Lookback = 1d;
let AllowedAdminUsers = dynamic([
	"system:serviceaccount:flux-system:kustomize-controller",
	"system:serviceaccount:argocd:argocd-application-controller"
]);
CloudAuditEvents
| where Timestamp > ago(Lookback)
| where DataSource =~ "Kubernetes Audit"
| extend Verb = tolower(coalesce(tostring(RawEventData.verb), OperationName))
| extend Resource = tolower(tostring(RawEventData.objectRef.resource))
| where Verb in ("create", "update", "patch")
| where Resource in ("clusterrolebindings", "rolebindings")
| extend Namespace = tostring(RawEventData.objectRef.namespace), Binding = tostring(RawEventData.objectRef.name)
| extend User = tostring(RawEventData.user.username), SourceIp = tostring(RawEventData.sourceIPs[0])
| extend RequestObject = tostring(RawEventData.requestObject)
| where RequestObject has "cluster-admin" or Binding has "cluster-admin"
| where User !in (AllowedAdminUsers)
| project Timestamp, Detection="K8S cluster-admin binding change", User, SourceIp, Namespace, Binding, UserAgent, RequestObject, RawEventData

About this query

Kubernetes Cluster-Admin Role Binding Created or Modified

Query Information

MITRE ATT&CK Technique(s)

Technique ID	Title	Link
T1098	Account Manipulation	https://attack.mitre.org/techniques/T1098
T1098.003	Additional Cloud Roles	https://attack.mitre.org/techniques/T1098/003

Description

Detects the creation or modification of RoleBindings or ClusterRoleBindings that grant 'cluster-admin' privileges. This behavior is a common indicator of privilege escalation or persistence within a Kubernetes cluster. The rule filters out known authorized service accounts used by common infrastructure tools like Flux and ArgoCD.

Author <Optional>

Name: Benjamin Zulliger
Github: https://github.com/benscha/KQLAdvancedHunting
LinkedIn: https://www.linkedin.com/in/benjamin-zulliger/

Defender XDR

Explanation

This query is designed to detect suspicious activities related to privilege escalation or persistence in a Kubernetes cluster. Specifically, it looks for the creation or modification of RoleBindings or ClusterRoleBindings that grant 'cluster-admin' privileges, which is a high-level administrative role. Such actions can indicate unauthorized attempts to gain elevated access within the cluster.

Here's a breakdown of the query:

Lookback Period: The query examines events from the past day (1d).
Exclusions: It excludes known authorized service accounts used by common infrastructure tools like Flux and ArgoCD to avoid false positives.
Data Source: It filters events from the "Kubernetes Audit" data source.
Actions Monitored: The query looks for "create", "update", or "patch" actions on "clusterrolebindings" or "rolebindings".
Detection Criteria: It checks if the action involves the 'cluster-admin' role and ensures the user performing the action is not in the list of allowed admin users.
Output: If such an event is detected, it outputs details including the timestamp, user, source IP, namespace, binding name, user agent, and the raw event data for further investigation.

In simple terms, this query helps identify unauthorized attempts to assign or modify high-level administrative roles in a Kubernetes environment, which could be a sign of a security breach.