GKE Creation of a RoleBinding Referencing a ServiceAccount

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

GKE Creation of a RoleBinding Referencing a ServiceAccount

Detects creation of a GKE RoleBinding or ClusterRoleBinding that grants permissions to a ServiceAccount, which may indicate privilege delegation or RBAC misconfiguration leading to elevated access.

Rule type: query

Rule indices:

logs-gcp.audit-*

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-6m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

Domain: Cloud
Domain: Kubernetes
Data Source: GCP
Data Source: Google Cloud Platform
Use Case: Threat Detection
Tactic: Persistence
Tactic: Privilege Escalation
Resources: Investigation Guide

Version: 1

Rule authors:

Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating GKE Creation of a RoleBinding Referencing a ServiceAccount

This rule detects creation of a RoleBinding or ClusterRoleBinding whose subject is a ServiceAccount. Attackers often bind over-privileged roles to an existing workload service account to operate with elevated rights.

Possible investigation steps

Review client.user.email, source.ip, gcp.audit.request.roleRef, and gcp.audit.request.subjects.
Determine which workloads run under the bound service account and whether the referenced role is cluster-scoped.
Correlate with secret access, exec, or additional RBAC changes from the same actor.

False positive analysis

Legitimate deployments and operators create service account bindings during routine releases.

Response and remediation

Remove unauthorized bindings, rotate the service account credentials, and tighten who can create RoleBindings.

Setup

edit

The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule.

Rule query

edit

data_stream.dataset:gcp.audit and service.name:"k8s.io" and event.outcome:success and
event.action:(
  "io.k8s.authorization.rbac.v1.rolebindings.create" or
  "io.k8s.authorization.rbac.v1.clusterrolebindings.create"
) and gcp.audit.request.subjects.kind:"ServiceAccount" and not client.user.email:(
  "system:apiserver" or
  "gcp:kube-bootstrap"
)

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Persistence
- ID: TA0003
- Reference URL: https://attack.mitre.org/tactics/TA0003/
Technique:
- Name: Account Manipulation
- ID: T1098
- Reference URL: https://attack.mitre.org/techniques/T1098/
Sub-technique:
- Name: Additional Container Cluster Roles
- ID: T1098.006
- Reference URL: https://attack.mitre.org/techniques/T1098/006/
Tactic:
- Name: Privilege Escalation
- ID: TA0004
- Reference URL: https://attack.mitre.org/tactics/TA0004/
Technique:
- Name: Account Manipulation
- ID: T1098
- Reference URL: https://attack.mitre.org/techniques/T1098/
Sub-technique:
- Name: Additional Container Cluster Roles
- ID: T1098.006
- Reference URL: https://attack.mitre.org/techniques/T1098/006/

« GKE CoreDNS or Kube-DNS Configuration Modified GKE Creation or Modification of Sensitive Role »